Security1 hSeptember 29, 2026, 21:30

RatHat shifts to malware-as-a-service with three C2 generations in six months

Cleafy found that RatHat's infrastructure evolves faster than the Android trojan itself: its command-and-control panels went through three generations in six months and rebranded from BlackCat to Panda Workshop. Nearly 100 deployments since April 2026 point to a malware-as-a-service model.

Infosecurity Magazine

Open source

RatHat shifts to malware-as-a-service with three C2 generations in six months

C2 panels build, sign and publish Android samples directly from the operator console
Panda Workshop V5 added 2FA for operators; V6 added a phishing download-page builder
The panel uses Gemini to estimate victims' bank balances and rank devices by value
Nearly half of observed campaign IP addresses sit on a single Singapore-based network

#RatHat#Cleafy#Gemini#Android

RatHat Android malware console uses Gemini to pick higher-value victims

Security

PamStealer macOS Malware Adds Live C2 Payload Decryption

Security

Zimperium finds RatHat: AI-powered Android malware steals passwords and 2FA codes

Security

RatHat shifts to malware-as-a-service with three C2 generations in six months

RatHat Android malware console uses Gemini to pick higher-value victims

PamStealer macOS Malware Adds Live C2 Payload Decryption

Zimperium finds RatHat: AI-powered Android malware steals passwords and 2FA codes

Say Hello to RatHat, a New AI-Powered Malware Invading the Android Ecosystem