Security researchers have found a new piece of Android malware that can work out your phone’s PIN by watching where your fingers land on the screen. What makes the story worth your time is not how clever it is — it is how ordinary the way in is.
What is actually going on
The software is called RatHat. Researchers at Zimperium, a mobile security company, published their findings on 16 September, and Malwarebytes, BleepingComputer and The Hacker News have reported the same details since.
Malware means a program installed on your device that was built to work against you. RatHat arrives the way most phone malware does: a text message or an advert leads to a web page pretending to be an app store, offering a popular app such as Chrome or a streaming service. You tap install, and the file you get is not that app.
Once it is running, it asks for one permission: Accessibility. Accessibility is a real Android feature that helps people who struggle with a touchscreen. It also lets an app see what is on your screen and tap buttons for you. RatHat asks for it with an excuse — in some countries it claims the permission is needed because of “network restrictions”. That claim is false.
With that permission, it switches on Developer Options and Wireless Debugging, features meant for app developers testing software over Wi‑Fi, and reads the six-digit pairing code off your own screen. It then pairs with your phone by itself, with no computer and no help from you. That hands it a level of control normally reserved for the phone’s owner.
From there it can place a fake login screen over a real banking app, so the details you type go to the attacker. It reads your text messages to catch the security codes banks send. And it records where your finger touches the glass, matches those positions against the layout of a phone keypad, and recovers your PIN or unlock pattern without ever seeing the screen.
It also sends a description of your screen to an AI assistant and asks where to tap next. Older malware followed a fixed script; this one adapts.
Why it matters to you
Your phone is where your bank app lives, along with your email, your photos and often your identity documents. Malware that can read your texts and watch your banking screen holds everything needed to log in and approve a payment.
The early cases aimed at two popular Chinese payment apps, WeChat Pay and Alipay. Malwarebytes notes that other financial apps can be targeted, and the delivery messages differ from country to country, so there is no reason to assume your bank is out of scope.
One detail worth keeping straight: RatHat is Android malware and does not run on iPhones. That is a fact about this program, not a promise that iPhones are never attacked.
What you can actually do
- Install apps only from the Google Play Store. Not from a link in a text message, and not from a page an advert sends you to.
- Check before you tap. If the “app” you opened has an address bar at the top, it is a website. Real apps do not have address bars.
- Say no to Accessibility. If an app asks for accessibility permission and it is not helping you see or hear something, deny it. A game, a photo app or a bank app has no reason to ask.
- Leave Developer Options and Wireless Debugging switched off. Legitimate apps never need them.
- Do not tap links in unexpected texts, even when the message names a company you use.
- Run a scan. Play Protect is built into Android: open the Play Store, tap your profile picture, choose Play Protect and run one. An anti-malware app from the Play Store can detect it too.
- If your phone is infected, plan for a factory reset. Uninstalling the app is not enough, because a hidden part of it survives and puts the app back. Back up your photos and contacts first.
Common misunderstandings
Myth: I would notice if something took over my phone
RatHat does not lock your screen or demand money. It waits quietly in the background, which is why spotting it took researchers digging through an unusually complicated file.
Myth: My PIN is safe because nobody can see it
This program never reads the digits. It records where your finger touches the glass, then compares those positions with your keypad layout. A PIN on a screen is not hidden from that.
Myth: Antivirus will clean it up
A scan can find it. Removing it is the harder problem, because part of it lives outside the app and puts the app back. Researchers say the reliable fix is a factory reset.
Myth: I have nothing worth stealing
You carry a bank branch in your pocket: login details, one-time codes, email and sometimes photographs of your passport. That combination is what these attacks are built to sell.
What to watch for next
The AI is the part to watch. RatHat asks a general-purpose assistant where to tap instead of following one fixed pattern, so blocking a single known step does not stop it. Security companies expect the same trick in other phone malware soon.
Expect more of these messages. Each is written for its target, so yours will not match your neighbour’s. Treat any unexpected request to install an app as a scam, whoever it appears to come from.
The one thing to remember
Malware needs your permission to do real damage. On Android, the permission that matters is Accessibility, and the door worth keeping shut is installing apps from outside the Play Store. Refuse both, and a program like this never gets in.
Image credits: “Smartphone Use” by Océanos y dados, via Wikimedia Commons, dedicated to the public domain under CC0 1.0. Facts here come from Zimperium’s zLabs research (16 September 2026) and reporting by Malwarebytes, BleepingComputer, The Hacker News and CNET.