The infrastructure behind the RatHat Android banking trojan has changed more than the malware itself, with successive command-and-control (C2) panels able to build malware, manage infected devices and use AI to rank potential victims.
In research published September 28, Cleafy said the implant had changed little from late 2025 through September 2026, while its C2 panel went through three generations in six months and rebranded from BlackCat to Panda Workshop.
Nearly 100 separate deployments since April 2026 have been observed, consistent with a malware-as-a-service (MaaS) model.
RatHat C2 Becomes a Malware Factory
Cleafy said the panels could build, sign and publish new Android samples directly from the operator console. They could also regenerate samples on a schedule, producing fresh files to evade hash-based detection while the underlying implant stayed largely unchanged.
Panda Workshop V5 added two-factor authentication (2FA) for operators, and V6 added a phishing download-page builder. Cleafy said account limits and role-based access within the panels were consistent with a commercial model in which customers operated their own RatHat instances.
Campaigns ran in parallel across Europe, Latin America and Southeast Asia, and nearly half of the observed IP addresses sat on a single Singapore-based network.
Cleafy also found that operators could use RatHat's wireless debugging access to deploy a native Go service with a single click from the panel, gaining shell-level control outside the Android application's permission model. The service could remain active after the malicious application was removed, until the next reboot.
AI Helps Rank RatHat Victims
Cleafy found the latest panel used Gemini to analyze SMS messages already collected from infected devices and estimate victims' bank balances. The resulting scores sorted devices into high-value and mid-value groups, helping operators identify targets without reviewing every infected phone by hand.
Cleafy stressed that the AI tool was used for victim prioritization, not to carry out fraud.
The malware used Gemini separately: when its static automation failed on unfamiliar Android interfaces, the implant sent details of the screen to a large language model (LLM) and asked where to tap.
Cleafy said earlier panels supported multiple AI providers, but Panda Workshop V6 consolidated the configuration around Google's Gemini.
The company warned that the device-side technique could revive automated transfer systems (ATS), long limited by the cost of scripting each banking app, although nothing in the samples performed a fraudulent transfer.