# Android malware uses AI to steal from banks

> RedHat, a Chinese banking trojan discovered by Zimperium zLabs, deploys an AI assistant to automate device control and bypass security measures.
- Title: Android malware uses AI to steal from banks · TechRadar
- Summary: RedHat, a Chinese banking trojan discovered by Zimperium zLabs, deploys an AI assistant to automate device control and bypass security measures. RedHat, a…
- Keywords: redhat malware, android banking trojan, zimperium zlabs, ai-powered malware, credential theft, chinese origin, cybersecurity, technology, Android, malware, uses, steal
- Source: TechRadar — https://techradar.com/pro/security/new-android-malware-can-deploy-ai-to-automate-device-control-and-it-can-even-bring-itself-back-from-the-dead
- Published: 2026-09-18T19:15:00+00:00
- Read time: 1 min
- Topics: redhat malware, android banking trojan, zimperium zlabs, ai-powered malware, credential theft, chinese origin, cybersecurity, technology
## New Android trojan discovered
Security researchers Zimperium zLabs found RedHat, a Chinese-origin Android banking trojan that uses an AI assistant to control infected devices without real-time operator involvement.
## How RedHat steals from banks
RedHat creates invisible overlays when victims open banking apps, capturing login credentials and one-time passwords to give attackers direct control over banking accounts.
## AI adapts to app changes
Unlike traditional banking trojans that break when apps redesign, RedHat's AI interprets screen layouts in real-time, instructing the malware how to proceed without hardcoded coordinates.

> RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation.
## Distribution methods
RedHat spreads via third-party app stores, social media, malvertising, and SMS spam. It requires Android's Accessibility permissions to function on infected devices.
## Persistence mechanisms
RedHat can reinstall deleted components and intercept uninstall attempts, cancelling them while displaying a fake error message to prevent victims from removing the malware.
## Scope remains unknown
Zimperium zLabs has not disclosed who RedHat's targets are or how many people may have been compromised by the malware so far.
## Key takeaway

RedHat, a Chinese Android banking trojan with an AI assistant, can steal credentials and reinstate itself after deletion, spreading via third-party stores and social media.