RatHat Android Banking Trojan Console Uses Gemini to Pick High-Value Victims

Three generations of control panels, little change to the trojan itself

According to Cleafy’s report, the RatHat Android banking trojan itself has changed little since late 2025. But the web control panel operators use to manage infected phones has been completely replaced, going through three generations in six months. Samples from late 2025 and February 2026 connected to an older panel called Fisher, while three new versions appeared between April and September 2026, named BlackCat Remote Control Management, Panda Workshop V5 and V6. All three share the same underlying code.

Each version also functions as a build tool. Operators can create a trojan within the panel, hide it inside a seemingly harmless app, sign it, and have the panel automatically publish it to Amazon S3 or a web server, with no need to handle hosting separately. The panel can also rebuild the app automatically on a schedule, for example every hour, generating a new file each time. This is aimed at defeating security tools that identify known malware by file hash.

Gemini used to estimate victims’ wealth and to help the trojan operate itself

The latest control panel supports only Google Gemini, and directs operators to Google AI Studio to obtain an API key. According to the report, the panel sends text message content collected by the trojan from victim phones to Gemini, which estimates the victim’s bank balance. Phones are then sorted into high value or medium value groups, letting operators prioritise more valuable targets. Cleafy found no evidence in the samples it analysed that the AI feature was used to directly transfer funds. Its role was limited to ‘deciding which victims are worth the operator’s time’.

The trojan itself also calls Gemini directly on the device. Because its built in tap commands are designed for specific phone brand interfaces, Android versions and languages, they fail on unforeseen devices. In that case, the trojan sends screen layout data to Gemini and taps the screen based on its instructions. The call is made directly from the phone using an API key stored in the trojan’s configuration. The Hacker News notes that another Android trojan called PromptSpy, described by security firm ESET in February this year, used the same technique of sending screen layouts to Gemini and following its tap instructions.

The trojan gains system level control via ADB

After installation, the app requests Accessibility permission, allowing it to read screen content and tap on the user’s behalf. The trojan uses this permission to enable wireless debugging itself, reads the pairing code shown on screen, and connects to the phone’s built in debugging tool, Android Debug Bridge (ADB). This gives it operating privileges as the Android system shell user (UID 2000), beyond what the app itself is normally granted.

Operators can launch a standalone program written in Go with one click from the control panel, maintaining control through a reverse channel, a connection initiated by the phone back to the operator’s server. This program uses tools called minicap and minitouch to stream the screen and simulate taps, without triggering permission prompts or showing a recording icon. However, both tools stop working on Android 14 and later. The Hacker News, citing analysis by security firm Zimperium, says this Go program keeps running even after the victim removes the app, until the phone restarts. It can also automatically reinstall the app and re-enable its Accessibility permission after deletion.

Nearly 100 deployments mostly linked to a single Singapore network

By searching control panel page titles and web code, Cleafy tracked nearly 100 separate panel deployments since April 2026, spread across Europe, Latin America and Southeast Asia. Nearly half of the observed IP addresses belonged to a single network registered in Singapore, AS4907. The report notes that the panel caps the number of operator accounts and hides certain features from non administrator users. This design only makes sense if users include customers the developer does not fully trust, that is, other criminal groups’ customers, consistent with a ‘malware as a service’ operating model.