Last seen September 28, 2026

AI Security Incident

RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy. The console stores what the malware collects from each phone,

Technical Severity
Low severity
Lifecycle Status

NEW

Sources

What Happened

RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy. The console stores what the malware collects from each phone,

Why This Matters

Current evidence identifies a security issue involving the affected technology, but does not yet support a more specific impact claim.

Recommended Action

Confirm whether april is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.

Exposure

My Interests Exposure

Exposure unknown

Recommended Response
Last Seen

Sep 28, 2026 23:08

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

GoogleGeminiConsole Uses GeminiIdentify HigherRatHat Android Malwareapril

Timeline

  • Incident first seen
    Sep 28, 2026 23:08

    BugSkan first recorded this incident.

  • RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
    Sep 28, 2026 23:08

    thehackernews.com · Research

Sources

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

thehackernews.com · Sep 28, 2026 23:08

RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy. The console stores what the malware collects from each phone,

Open publisher source

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match

Want personalized relevance?

Create an account to see which incidents overlap with your interests.

← Back to incident intelligence