AI-powered Android banking trojans target financial institutions

Cybersecurity researchers have identified a new wave of sophisticated Android banking trojans that leverage artificial intelligence to enhance their effectiveness.

One malware, known as RatHat, utilizes Google’s Gemini AI to analyze intercepted messages and estimate the bank balances of infected victims. This allows operators to prioritize high-value accounts. Cleafy has reported approximately 100 deployments of the RatHat control console since April 2026. The malware operates on a malware-as-a-service model, using fake login overlays and abusing Android Debug Bridge (ADB) to gain control of devices.

Separately, the RemControl trojan has been detected targeting over 30 financial institutions across Europe, including France, Italy, Spain, Poland, and Portugal. Researchers at Group-IB discovered that portions of RemControl’s code were generated using AI assistants by bypassing security restrictions. This malware is distributed through fraudulent advertisements on social media platforms like Facebook and Instagram, using fake screens to steal banking credentials and neutralize Android protections.