New Android malware can deploy AI to automate device control — and it can even bring itself back from the dead

Zimperium zLabs discovered RedHat , a Chinese‑origin Android banking trojan with AI assistant AI interprets screen layouts in real‑time, enabling credential theft and bypassing app redesigns Distributed via third‑party stores, social media, malvertising, and SMS; persistence blocks uninstall attempts There is an Android malware out there that comes with an AI assistant that tells it what to do.

The assistant seems to be independent of the malware’s operator, allowing the tool to work without requiring the operators to be present in real-time.

The malware in question is called RedHat.

It was discovered by security researchers Zimperium zLabs, who believe it is of Chinese origin.

It is currently being distributed via third-party app stores, social media, malvertising, and SMS spam, and requires Android’s Accessibility permissions to work.

The malware itself is a typical banking trojan - it creates an invisible overlay every time the victim brings up a banking app, capturing login credentials and one-time passwords, and thus giving attackers direct control over people’s banking accounts.

AI-powered eyes But what makes RedHat stand out from a sea of Android banking trojans is its AI-powered component.

The model serves as a kind of remote “eyes and hands” for controlling the victim’s phone.

Usually, when criminals develop banking trojans, they need to code exact coordinates of the layout for it to work.

They need to code where the password is entered, or where the login button is.

If the banking app gets redesigned and changes its layout, the malware breaks.

With AI, that is no longer a problem.

RedHat gets a picture of what’s on the screen, sends it to the AI assistant, which then instructs the malware on how to proceed.

"RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation," Zimperium explained.