[rathat]

September 29, 2026

• RatHat Android malware's operator console calls Google Gemini to triage infections and surface higher-value victims (The Hacker News). · Threat Activity

in PitScaler Goes Global: Citrix NetScaler Chain Exploited for Weeks Before Anyone Had a Patch

September 20, 2026

• RatHat, an Android RAT attributed to China-based operators, abuses ADB to retain shell access after the app is uninstalled, and ships an AI-driven component for navigating the compromised device UI. Distribution is via targeted smishing and malvertising into fake third-party download portals. The Hacker News · Detection & Defence

in Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks

September 18, 2026

• RatHat Android malware enables Developer Options and Wireless Debugging to reach an ADB shell context with no attached PC, then installs a Go agent for persistence and an FRP reverse-proxy client for tunneling. Its distinguishing trick: it serializes the live Accessibility tree to XML and asks an unnamed AI assistant for element coordinates and navigation commands, making UI automation adaptive rather than scripted; Chinese-language prompts point to Chinese-speaking operators (BleepingComputer). · Threat Activity

in Plugin4Shell Turns Pinned Agent Plugins Into Zero-Click RCE