New Android Malware Steals Your Bank Passwords by Tracking Your Fingers

Researchers at Zimperium have found a new malware called RatHat that infects Android devices through phishing and malicious ad links, then escalates its privileges to read and decipher your touch input, including PINs and passwords for banking applications.^[1]

That means even if you use a strong password, a PIN, and two-factor authentication to protect your logins, none of it would help if your Android device is infected with RatHat. This new malware doesn’t just read your screen. It can track your finger movements and log the coordinates of your touches on the device.

An attacker could then use this information to steal your banking credentials, potentially carry out unauthorized transactions, and gain access to your accounts. RatHat can also intercept SMS messages and notifications, giving attackers access to OTPs and potentially more private information that could help them launch convincing phishing attacks.

Here’s everything you need to know about RatHat and the steps you should take to protect your Android device from malware.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

How RatHat hijacks your Android device

The Zimperium report highlights that the attack starts with bogus phishing and smishing texts, as well as malicious advertisements, which lead victims to fake download pages. These pages can be disguised as popular streaming apps or even browsers like Chrome. They then persuade users to sideload apps onto their Android devices.

Once the victim downloads the malicious APK, the app asks the user to turn on Android’s Accessibility Service. This is a legitimate Android feature designed to help people with disabilities interact with their devices. However, an app with Accessibility access can also read the content on your screen and perform actions on your behalf.

The attacker uses these accessibility features to turn on the device’s Developer Options, along with Wireless Debugging. The latter allows developers to connect a computer to the phone over Wi-Fi to test and debug their apps using Android Debug Bridge (ADB).

ADB is a command-line tool that developers use to communicate directly with an Android device. They can use it to install apps, run system commands, and pull logs. Once there, however, RatHat repurposes it for malicious purposes.

Simply turning on Wireless Debugging isn’t enough. Android also requires a pairing step where a six-digit code must be entered to authorize the connection. Since RatHat already has Accessibility access, it can read the code directly from your screen and pair with the attacker’s device automatically.

The attacker then uses the shell-level ADB session to install two native components on the victim’s device. The first is an agent capable of running commands with elevated privileges, while the other is a reverse proxy client that can open a persistent tunnel back to the attacker’s server.

Usually, your phone sits behind your mobile network’s NAT (Network Address Translation) and firewalls, so random computers on the internet cannot simply reach in and connect to your phone. A reverse proxy tunnel flips the direction of this connection.

Instead of the attacker trying to connect to your phone, your phone reaches out to the attacker’s server and keeps that connection open. Once the tunnel exists, the attacker’s server can send commands through it.

How does RatHat steal your information

RatHat uses overlay techniques to target specific apps and steal your credentials. When you open your banking app, you might believe that you’re interacting with your legitimate banking provider. However, RatHat can inject fake overlays on top of these apps that mimic their real interfaces.

When you enter your username, password, OTPs, or other multi-factor authentication codes on these fake pages, the attackers can capture them and potentially use them to log into your banking portal from their own device. RatHat can also intercept SMS messages and notifications, allowing attackers to capture verification codes sent to your phone.

However, some apps have protections against on-screen or overlay-based credential theft. To work around these protections, RatHat employs another credential-stealing technique.

One of the most novel capabilities of RatHat is its ability to recognize and decode raw touch coordinates directly from the input driver. This means it can determine the exact spot on your screen that you touch and then match those coordinates against known databases of keypad and pattern-lock layouts to decipher PINs and unlock patterns.

What can you do to protect yourself

While RatHat can be dangerous once inside your Android device, there are several steps you can take to prevent it from stealing your logins.

1. Only download apps from official stores: Never download apps from unofficial sources or third-party websites. Stick to the official Google Play Store or other trusted sources.
2. Be wary of phishing texts and emails: Phishing messages have become increasingly difficult to identify, but you should be especially cautious with urgent messages that pressure you to act quickly. They may offer a tempting deal, claim there’s a problem with your account, or create another sense of emergency.
3. Don’t grant extensive app permissions: Even if you accidentally download RatHat, it needs Accessibility access to carry out much of its attack chain. If you don't grant that permission, you can prevent it from taking those next steps. Review your app permissions regularly and make sure apps only have the access they genuinely need. For instance, entertainment, streaming, gaming, and ordinary browser apps have no normal reason to request Accessibility access.
4. Keep Developer Options and Wireless Debugging disabled: Unless you actively need these features for development, there’s little reason to leave them enabled.
5. Use a third-party antivirus program: A reliable antivirus solution with real-time web protection can alert you if you accidentally click on a malicious phishing link. Since RatHat starts with phishing, web protection can help prevent you from reaching the malicious download page in the first place.
6. Consider identity theft protection: If RatHat compromises your device, your personal information could be misused for phishing or identity theft. An identity theft protection service can alert you when your information appears in known breach databases or on the dark web, helping you respond to potential misuse sooner.

If you believe RatHat has already infected your device, simply uninstalling the suspicious app won’t do. The researchers found that RatHat can maintain a hidden background component that survives even after the main app is removed and can reinstall it.

The researchers recommend performing a factory reset before restoring only essential data from trusted sources. You should also change your banking passwords from a separate, trusted device and contact your bank to review your account access and recent transactions.

The bottom line

RatHat, if it gets onto your Android device, can steal your banking credentials, login PINs, verification codes, SMS messages, and other screen content, potentially harming you directly and gathering enough context about your life to make subsequent scams and phishing attempts more convincing.

However, avoiding RatHat is surprisingly easy, as it largely comes down to good security hygiene. Don’t download apps from shady third-party sources, be cautious with unsolicited links and ads, and never give an app Accessibility access unless you have a clear reason to trust it.

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news