New AI-assisted malware being used to compromise bank info on Android phones: How to protect yourself

An AI-assisted malware threat was detected in September by security firm Zimperium.¹  Coined “RatHat,” the malware gains extensive control of Android phones and platforms to compromise user credentials and security codes.

RatHat typically reaches consumers through malicious advertisements, text message phishing, and deceptive websites that convince users to install a malicious Android application package, or APK, from an illegitimate app store, instead of the legitimate Google Play Store.²

Compromising your phone or device’s banking information

Once installed, the user is guided to grant the app special Android accessibility permissions to manipulate legitimate device functions and gain deeper access to the phone.

“The infection chain is unusually elaborate for a mobile threat, combining social engineering, accessibility abuse, and remote AI decision-making into a single pipeline,” writes Pieter Arntz of Malwarebytes Labs.³

As Zimperium, which has attributed the threat to a Chinese-based threat actor, outlines in its report:¹ “The malware deploys sophisticated, fake interfaces designed to mimic legitimate banking and payment apps, tricking users into providing their financial login credentials … RatHat uses AI to intelligently navigate and control the device interface in real time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation.”

RatHat can also monitor touch activity to reconstruct PINs, passwords and screen-unlock patterns.¹

How to reduce your risk

Consumers can significantly reduce their risk by:³

• Never installing an Android app from a link received unexpectedly by text or from an unfamiliar website or advertisement
• Obtaining apps only through reputable sources such as the Google Play and Apple App Stores
• Carefully evaluating the necessity and appropriateness of requests for accessibility permissions for all installed applications
• Treating unexpected requests to enable Developer Options or Wireless Debugging on mobile phones as significant warning signs
• Stop using your phone if you think it may be compromised, and immediately contact your financial institution using a trusted telephone number if you think your financial account may have been compromised
• Use a separate, trusted device such as a desktop or laptop to change important passwords

If your device is infected with RatHat, experts advise that a complete factory reset is required, because the app can survive normal app removal techniques.³ RatHat is part of the new threat landscape of adaptive AI-assisted malware executed from servers rather than contained within traditional mobile apps.

How Old National Bank protects clients

Old National Bank is committed to protecting customers' accounts and personal information. Old National uses security protocols for online and mobile banking and debit-card fraud prevention and provides customers with tools including account monitoring, debit-card controls and transaction alerts.

Customers should remember that Old National only posts its mobile applications on reputable app sites like the Google Play Store and Apple App Store, and we will never request sensitive information through an unsolicited email, phone call or text message. Regularly reviewing accounts through digital banking and promptly reporting unfamiliar activity can help identify potential fraud sooner. Click here to learn more about protection for today, and new threats from tomorrow, with Old National.

 

References

1. Zimperium zLabs, RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts, Sept. 16, 2026.
2. SecurityWeek, RatHat Android Trojan Uses AI for Automation, Sept. 21, 2026.
3. BleepingComputer, New RatHat Android malware uses AI to automate device control, Sept. 17, 2026.
4. Malwarebytes, New Android malware uses AI to steal bank logins and PINs, Sept. 18, 2026.