NewsHive
CONTACT USANALYST PORTAL →
securityBACKGROUND

New Android malware uses AI to steal bank logins and PINs

BACKGROUND
1 SIGNALFIRST DETECTED 18 September 2026
Narrative synthesis pending — 1 signal collected.
How the story developed
18 Sept
Other feeds and industry voices
17 Sept
New RatHat Android malware uses AI to automate device control

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. [...]

REPORT · WHAT · BleepingComputerOPEN STORY
18 Sept
RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence

REPORT · WHERE · The Hacker NewsOPEN STORY
18 Sept
RatHat: AI-Powered Mobile Threat Steals Android Shell

<h2> 1. Basic Information </h2> <ul> <li>Original Title: RatHat: AI-Powered Mobile Threat is Here for Your Credentials &amp; Bank Accounts</li> <li>Source: Zimperium zLabs</li>

REPORT · WHAT · Dev.toOPEN STORY
13 Aug
New Android malware lets criminals use your bank card in real time

Social engineering, a Remote Access Trojan (RAT), and NFC relay malware walk up to an ATM. It's no joke. Together, they can empty your bank account.

REPORT · WHAT · Malwarebytes LabsOPEN STORY
16 Jun
New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds

Security researchers at&nbsp;Zimperium's zLabs&nbsp;have documented a new Android banking trojan, Rokarolla, that targets 217 banking and cryptocurrency apps and packs 137 remote

REPORT · WHAT · The Hacker NewsOPEN STORY
17 Jun
Rokarolla Android malware can take over your phone and steal banking logins

Researchers have uncovered an Android banking Trojan that targets more than 200 banking and cryptocurrency apps and can take over infected devices.

REPORT · WHAT · Malwarebytes LabsOPEN STORY
28 Sept
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has&nbsp;traced nearly

REPORT · WHO · The Hacker NewsOPEN STORY
Sources
Malwarebytes Labs

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →