New Android Malware “RatHat” Disguises Itself as Chrome to Hijack Your Phone
A newly discovered strain of Android malware is tricking people into installing it by posing as trusted apps, and once it’s on a device, it can quietly take over admin-level controls without the user doing anything further.
How RatHat Gets In
Mobile security firm Zimperium identified the malware, which it calls RatHat. It spreads through fake web pages designed to look like the Google Play Store, luring victims into downloading what appears to be a legitimate app such as Google Chrome. Once installed, the app asks for accessibility permissions, seemingly a routine request, but one that gives it the access it needs to take over the device.
From there, RatHat uses those permissions to navigate through phone settings, enable Wireless Debugging (a legitimate developer tool), and grant itself ADB Shell access, effectively handing itself admin-level control. It then installs an AI-assisted agent that runs system commands to extract data, along with a proxy client that sends stolen information back to attackers.
What Makes It Dangerous
Unlike ransomware, RatHat doesn’t announce itself. It runs quietly in the background, capturing usernames, passwords, and two-factor authentication codes as they appear on screen. It can also record raw touchscreen input to reconstruct PIN codes and unlock patterns, and it can intercept SMS messages, including security codes.
Zimperium traces the malware to attackers based in China, with the primary targets being financial apps like WeChat Pay and Alipay. Researchers have so far identified 162 infected apps reporting back to a network of a dozen attacker-controlled servers.
Who’s at Risk
The good news is that RatHat only reaches devices through sideloading, meaning apps installed from outside the official Play Store. A Google spokesperson confirmed that Play Protect, which runs by default on Android devices with Google Play Services, already detects and blocks RatHat, and that no infected apps have been found on the Play Store itself.
Reputable antivirus apps should also catch it, since it’s now publicly documented malware. Malwarebytes offers a 14-day trial with real-time protection, though even its free version can run scans to detect it.
Why It’s Hard to Remove
Once RatHat is installed, getting rid of it isn’t simple. According to Malwarebytes research engineer Sav Wheeler, the malware’s tendency to disguise itself as other apps and dynamically shift its behavior through its AI component means standard antivirus quarantining isn’t enough. Uninstalling the app doesn’t help either, since the malware retains admin access through hidden secondary files that let it reinstall itself repeatedly. A full factory reset is currently the only reliable way to remove it.
How to Avoid It
Protecting against RatHat comes down to a few habits. Avoid clicking links in unsolicited texts or emails, since that’s how most infections start. Double-check that you’re on the real Google Play Store rather than an imitation, a good tell is that legitimate apps never have a URL address bar. And if you’re prompted to “reinstall” an app like Chrome that’s already on your phone, treat that as a red flag.
Most importantly, don’t grant accessibility permissions to apps unless you’re certain of what they are. Wheeler notes that even after a malicious app is downloaded, it remains largely powerless until it’s handed those elevated permissions, making that the last and most effective line of defense.