In a recent analysis published by Cleafy on September 28, significant transformations in the infrastructure of the RatHat Android banking trojan have been revealed, overshadowing any changes to the malware itself. The report suggests that the command-and-control (C2) panels linked to RatHat have undergone substantial evolution, with three distinct generations emerging within a mere six-month timeframe, initiating a rebranding process from BlackCat to Panda Workshop. While the core malware has shown relative stability, the capabilities of the accompanying C2 infrastructure have advanced dramatically, allowing for a more efficient and sophisticated operation.
According to Cleafy, there have been nearly 100 separate deployments of the RatHat trojan since April 2026, indicative of a malware-as-a-service (MaaS) model. This suggests that the operators have likely been leveraging this infrastructure to deliver the malware to various clients, providing them with tools to conduct widespread fraudulent activities effortlessly.
### RatHat C2 as a Malware Production Hub
Cleafy has detailed how the upgraded C2 panels function similarly to a malware factory, capable of building, signing, and publishing new Android malware samples directly from the operator console. This innovative feature enables the generative production of fresh malware files on a schedule, thus evading hash-based detection methods. While the core implant remains largely unchanged, this capacity for continuous regeneration allows for sustained operations.
The evolution from BlackCat to Panda Workshop has seen the introduction of significant new features. For instance, the latest version, Panda Workshop V5, integrated two-factor authentication (2FA) for added security for operators. Following this, Panda Workshop V6 introduced a phishing download-page builder, which further enhances the operator’s ability to craft deceptive interactions aimed at users. Additionally, this recent iteration suggests a commercial model where customers can run their instances of RatHat, supported by role-based access and account limitations that align with business operations.
Furthermore, campaigns utilizing RatHat malware have been observed operating in parallel across various regions, including Europe, Latin America, and Southeast Asia. Intriguingly, a substantial portion of the observed IP addresses associated with these campaigns traces back to a single network based in Singapore, hinting at a centralized operation possibly extending its reach into multiple geographical areas.
Cleafy highlights another critical feature of the RatHat operation: the wireless debugging access that allows the deployment of a native Go service with just a single click from the C2 panel. This capability grants operators shell-level control beyond the confines of the Android application’s permission model. Alarmingly, this service can persist even after the malicious application has been uninstalled, remaining active until the device is rebooted.
### AI-Driven Targeting of Victims
One of the standout features of the latest panel is its integration of artificial intelligence (AI) tools, specifically Gemini, which significantly enhances the operational capacity of RatHat. According to Cleafy, this AI analyzes SMS messages collected from infected devices to estimate victims’ bank balances. By assigning scores based on these evaluations, it classifies devices into high-value and mid-value categories, thereby streamlining the targeting process. This allows operators to efficiently identify lucrative targets without laboriously sifting through each compromised device manually.
Notably, Cleafy emphasizes that while this AI tool aids in victim prioritization, it does not itself execute fraudulent transactions. Instead, the malware employs Gemini for a different purpose: in scenarios where static automation fails, the implant can relay details about the current screen of the device to a large language model (LLM) and receive guidance on user interactions, such as where to tap next.
While earlier iterations of the C2 panels supported various AI providers, the advancement to Panda Workshop V6 has streamlined this capability to focus primarily on Google’s Gemini. This could signify a strengthening of the malware’s operational capabilities as it optimizes interactions with banking applications.
Cleafy forewarns that the device-side techniques facilitated by these advancements could potentially revitalize automated transfer systems (ATS), which have previously been hindered by the need for specific scripting for each banking application. However, it is essential to clarify that no documented instances of direct fraudulent transfers have been witnessed in the samples reviewed.
The landscape of mobile banking security continues to evolve as complex threats like RatHat emerge, highlighting the need for individuals and institutions to remain vigilant and informed about the potential risks posed by such sophisticated malware activities.