At a Glance Malware Family 7 Android RAT families (cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat/GhostGrab, and tenxen) paired with the d-miner XMRig dropper Threat Actor Confirmed analytical cluster tracked as CyberDakait; suspected multiple independent sub-project developers (no formal named group attributed) Target / Victims

At a Glance Malware Family 7 Android RAT families (cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat/GhostGrab, and tenxen) paired with the d-miner XMRig dropper Threat Actor Confirmed analytical cluster tracked as CyberDakait; suspected multiple independent sub-project developers (no formal named group attributed) Target / Victims

https://www.osintinvestigate.com A major Android malware campaign has compromised 17,960 devices and intercepted over 7.6 million SMS messages. Discover how banking trojans use fake bank calls, phishing websites, and malicious apps to steal financial credentials, credit card details, and one-time passwords, and learn how to protect your smartphone from mobile banking fraud.

At a Glance Malware Family GhostBat RAT (operating within the GhostX operator ecosystem) Threat Actor Confirmed as the GhostX operator infrastructure; suspected Malware-as-a-Service (MaaS) model with unattributed individual operators Target / Victims Android users in India; 60 targeted financial and UPI apps (641 compromised devices and 244 stolen UPI PINs documented in prior related Firebase clusters) Delivery Vector

At a Glance Malware Family Hirudo banking trojan (Android remote access trojan and app-patching toolkit) Threat Actor Unattributed financially motivated group (Chinese-language backend panel observed; identity unconfirmed) Target / Victims Thousands of compromised device records; 8 patched apps across 7 Indonesian banks, plus 42 financial targets across China, India, Malaysia, Mexico, Morocco, and Thailand Delivery Vector

Discover Midnight Mimosa, a dangerous Android malware campaign found in low-cost smartphones across more than 150 countries. Learn how preinstalled firmware malware works, why it threatens mobile security, and how to protect your devices.

Ransomware attack disrupts Japan’s IDCF Cloud used by govt clients IDC Frontier, the SoftBank-owned Japanese cloud and infrastructure provider, has confirmed that a ransomware attack beginning on Octo...

RATHat Banking Trojan Leverages Google Gemini The insidious RATHat banking trojan now actively employs Google Gemini as an intelligent assistant to infect smartphones. According to dedicated researchers at Cleafy, this neural network helps the malware navigate unfamiliar Android interfaces. Furthermore, it assists the malicious operators in identifying more lucrative victims. Deceptive Initial Infection As cybersecurity specialists report, the elaborate scheme always begins with clever deception.

Researchers at the Ukrainian Cyber Security Institute have warned that there are mobile malware campaigns targeting both Android and iOS devices, with attackers utilizing malicious applications and sophisticated exploit chains to target military personnel, government officials, and other individuals. In a recent report released by the Ukrainian State Service of Special Communications and Information Protection (SSSCIP), the findings were highlighted, highlighting the increasing use of smartphones for communication and obtaining sensitive data. An exploit kit designed for compromising iPhones was identified as one of the key tools identified in this activity, known as DarkSword.  During watering-hole attacks, the attackers compromised legitimate websites visited by the intended targets and modified them in order to deliver the attack. A number of Ukrainian news and government websites were targeted by attackers, enabling them to exploit vulnerabilities in Apple’s Safari browser and iOS.  As soon as an iPhone is compromised, DarkSword can be used to gather sensitive data such as login credentials, messages, contacts, and call histories without the victim having to interact significantly. In addition, earlier research has suggested that the activity may be linked to a Russian-led hacking operation targeting Ukrainians.  Researchers previously reported that the threat actor identified as UNC6353 used DarkSword against Ukrainian users from as late as late 2025. As part of the activity, compromised sites belonging to a local news outlet covering the war and a local court were compromised, and a possible infection was identified at a Ukrainian food processing facility.  DarkSword is described as an attack tool that is designed for a short period of time rather than a long-term solution. This technique has been shown to be capable of extracting sensitive information within minutes and then erasing traces of the compromised device within minutes. Additionally, Ukrainian authorities are tracking activities associated with groups known as UAC-0244 and UAC-0263, which use websites that appear legitimate and encourage users to download applications. This campaign extends to Android devices as well.  To attract visitors, UAC-0244 created websites impersonating Ukraine's 3rd Army Corps and other services. One group, UAC-0263, distributed CamelSpy, an Android malware application capable of collecting information regarding device location, SIM card information, contacts, call logs, and stored images. It has been found that the BTMOB malware provides remote access to compromised devices and is capable of stealing information from them. It uses websites promoting supposed air raid alert applications, fuel discounts, and other services.  A number of these campaigns demonstrate how attackers use familiar online services to disguise malicious activity. Ukraine's SSSCIP reported that threat actors used platforms such as GitHub to host malicious files, Telegram for transferring stolen information, Cloudflare for concealment of part of their network activity and Ngrok for encrypting stolen data. Those mobile attacks are part of a wider cyber campaign targeting Ukraine.  CERT-UA reported 3,137 cyber incidents during the first half of 2026, representing an increase of approximately 8% from the preceding six-month period. There are still a number of security risks involved in mobile devices for Ukrainian citizens, with malicious websites, apps, and exploit tools being used to target iOS and Android devices.

At a Glance Attribute Details Malware Family Android Toll Fraud family (including Messenger Pro and AqMu builds) Threat Actor Unknown (unconfirmed attribution) Target Victims Android users across Poland, France, China, and 12 other countries Delivery Vector Deceptive Meta Facebook advertisements redirecting to Google Play listings Key Capabilities Multi-stage in-memory DEX execution, background WebView billing, premium SMS theft Source

At a Glance Attribute Details Actor or Group Operator tracked as UNKK Activity Type Android banking malware, credential theft, remote device control Targets or Victims Retail banking customers in Europe, Canada, and the Middle East Scale Targeted over 30 banking institutions; total victim count unconfirmed Jurisdiction / Status Unknown operator; uncharged Source Group-IB Threat Intelligence TL;DR Cybersecurity researchers identified the RemControl Android banking trojan targeting mobile users.

✓ AI Security Awareness Training lessons from RemControl, an Android banking malware campaign targeting Europe and Canada through fake apps and phishing overlays.

https://www.osintinvestigate.com RatHat is a newly discovered Android Trojan that uses generative AI to navigate infected devices, steal credentials, capture user input, maintain persistence, and evade removal. In this episode, we explore how RatHat works, how attackers distribute it through smishing and malvertising, and why AI-powered automation could represent a new evolution in mobile malware.

 A new Android backdoor called RatHat utilizes an AI-powered system to remotely navigate compromised devices, while also stealing sensitive information and using a variety of methods to maintain its presence. Researchers at Zimperium’s zLabs found indications that RatHat may be associated with threat actors based in China after they discovered Chinese language prompts within the malware’s AI subsystem.  The malware is reported to be distributed through malicious advertising, SMS messages and phishing websites that promote APK downloads outside Google Play. RatHat takes advantage of Android’s Accessibility permissions to obtain extensive control over infected devices. This allows it to enable Developer Options and Wireless Debugging, granting it a local shell-level execution environment without the need for a separate computer. Researchers observed similarities with this technique that have been previously seen in the ToxicPanda and RedHook Android malware families.  The malware utilizes Android Debug Bridge (ADB) access to install a Go-based agent called liblocal-service.so. The agent can execute commands with ADB shell privileges, bypassing battery restrictions and establishing persistence. It can also restore the malware in the case that the main component is removed or stopped. The relationship works in both directions, with the malware being able to restore the agent if the agent itself is deleted.  RatHat also makes use of a second component, libmedia_codec.so, which acts as an FRP reverse-proxy client and establishes a persistent tunnel to the attackers. The malware has the ability to display HTML overlays over targeted banking and cryptocurrency applications in order to acquire the users’ credentials. Its information-stealing capabilities include SMS messages and notifications, including one-time passwords. RatHat can also monitor text changes, extract URLs from browser address bars and capture lock-screen PINs, passwords and unlock patterns.  One of RatHat’s most interesting features is its AI-powered interface automation engine. According to Zimperium, the malware converts the Android Accessibility tree into XML and sends the resulting information to an unnamed popular AI assistant. This system can recognize the screen coordinates of requested interface elements and determine their displayed text and provide navigation commands such as scrolling instructions. This enables the malware to navigate Android interfaces more dynamically than other malware that exclusively rely on predetermined scripts.  Zimperium stated that the AI-driven system makes the malware more adaptable and arguably harder for security software to detect. RatHat actively prevents victims from uninstalling the malware. When an uninstall confirmation screen appears, the malware can intercept the process and cancel the removal and display a fake Google Play overlay, which shows a fraudulent error message. The malware also contains a number of anti-analysis measures, including APK container manipulation, an unusually large 61MB Android manifest and invalid DEX pseudo-instructions that are designed to confuse or disrupt the functionality of security analysis tools.  Android users are advised to avoid downloading APK files from outside Google Play unless the publisher is explicitly trusted and to be careful when granting Accessibility permissions to applications. In addition, users should regularly scan their devices using Google Play Protect.

Zimperium researchers have uncovered RatHat, an #Androidmalware strain tied to China-based threat actors that leans on an AI chatbot to read screens.

Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. "Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses

Security researchers recently uncovered the Mantax Otax Android malware. This dangerous Indonesian mobile ransomware integrates deep espionage capabilities with aggressive file encryption. At a glance Malware family: Mantax Otax (and Mantax v2) Threat actor: Suspected Indonesian threat actors Target or victims: Android users (approx. 210 observed devices) Delivery vector: Sideloaded APKs via third-party sharing sites Key capabilities: AES encryption, screen recording, PIN theft, live chat extortion…

At a glance Malware family: Vwork and Gigabud Threat actor: GoldFactory (confirmed attribution) Targets or victims: Mobile banking users across 11 countries Delivery vector: Social engineering via phishing sites and malicious sideloaded apps Key capabilities: Android Work Profile abuse, app cloning, remote device control, credential harvesting Source: Group-IB Threat Intelligence TL;DR Researchers identified Vwork Android malware operating as a malicious companion to the Gigabud banking trojan.