Zimperium zLabs (16 September 2026) details RatHat, an Android malware strain they link to China-operating actors. Distribution is primarily smishing and malvertising to third-party APK portals (outside Google Play). Once installed it abuses Accessibility permissions, enables Developer Options / Wireless Debugging for local ADB self-pairing, and stages native Go agents (liblocal-service.so persistence/keylogging; libmedia_codec.so FRP reverse-proxy tunnel) with shell-level privileges and mutual self-restore if either component is removed.

Credential theft: banking/crypto HTML overlays, SMS/OTP interception, browser URL capture, and hardware-level reconstruction of lock-screen PIN/password/pattern from touch input. Distinctive: an AI UI-automation engine serialises the live Accessibility tree to XML and queries a generative AI assistant (unnamed in the Zimperium report; prompts observed in Chinese) for element coordinates, on-screen text, and navigation actions (e.g. SCROLL_DOWN), making automation more adaptable than fixed scripts.

Anti-removal: intercepts uninstall confirmation and shows a fake Google Play error overlay; anti-analysis includes bloated manifest and invalid DEX tricks.

UPDATE (Cleafy TIR “From BlackCat to Panda Workshop”; The Hacker News 28 Sep 2026): implant stayed largely static late-2025→Sep 2026 while the C2 panel was replaced — Fisher → BlackCat Remote Control Management (Apr 2026) → Panda Workshop V5 → hardened Panda Workshop V6 (Gemini-only AI config; obfuscated; phishing download-page host). Panel is a malware factory (build/sign/publish; scheduled rebuilds for hash evasion; S3/CloudFront or BaoTa publish). ~100 deployments since April 2026 (Europe, LATAM, SE Asia) consistent with MaaS.

Gemini used on both sides: on-device UI navigation when automation fails, and panel-side SMS analysis to estimate victim bank balances and prioritise high-value phones — not to move money in analysed samples. Primary remains Zimperium for the implant; Cleafy for operator-panel evolution; wire: THN 28 Sep.