From TechRadar · · 1m 20s
Android malware uses AI to steal from banks
RedHat, a Chinese banking trojan discovered by Zimperium zLabs, deploys an AI assistant to automate device control and bypass security measures.
In brief
RedHat, a Chinese banking trojan discovered by Zimperium zLabs, deploys an AI assistant to automate device control and bypass security measures. RedHat, a Chinese Android banking trojan with an AI assistant, can steal credentials and reinstate itself after deletion, spreading via third-party stores and social media…
New Android trojan discovered
Security researchers Zimperium zLabs found RedHat, a Chinese-origin Android banking trojan that uses an AI assistant to control infected devices without real-time operator involvement.
How RedHat steals from banks
RedHat creates invisible overlays when victims open banking apps, capturing login credentials and one-time passwords to give attackers direct control over banking accounts.
AI adapts to app changes
Unlike traditional banking trojans that break when apps redesign, RedHat's AI interprets screen layouts in real-time, instructing the malware how to proceed without hardcoded coordinates.
“RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation.”
Distribution methods
RedHat spreads via third-party app stores, social media, malvertising, and SMS spam. It requires Android's Accessibility permissions to function on infected devices.
Persistence mechanisms
RedHat can reinstall deleted components and intercept uninstall attempts, cancelling them while displaying a fake error message to prevent victims from removing the malware.
Scope remains unknown
Zimperium zLabs has not disclosed who RedHat's targets are or how many people may have been compromised by the malware so far.
Here's the gist
RedHat, a Chinese Android banking trojan with an AI assistant, can steal credentials and reinstate itself after deletion, spreading via third-party stores and social media.
