RatHat Malware Hands Victim Ranking to Gemini, Now Sorting Infected Phones by Bank Balance
Ourtake
Banking malware is now using commercial LLMs to decide which infected phones are worth the most to criminals.
What happened
Cleafy researchers found that the RatHat Android banking trojan's command-and-control panel, now called Panda Workshop, used Google's Gemini to score infected devices by estimated bank balance. The malware also used Gemini to choose screen taps when its automation failed. Nearly 100 deployments since April 2026 were observed, though no fraudulent transfer was found in the samples.