#Android

RatHat: the Android banking trojan whose control panel asks Gemini which victims are worth robbing

Cleafy Labs counted nearly 100 deployments of RatHat's operator console since April 2026. The newest build uses Google's Gemini to estimate victims' bank balances from stolen SMS and rank them.