A newly discovered Android banking trojan hands its dirty work to an AI model instead of hard-coded scripts.
Security researchers at Zimperium zLabs found the malware, dubbed RedHat, which they believe originated in China. RedHat spreads through third-party app stores, social media, malvertising, and SMS spam, then requests Android's Accessibility permissions to take hold. Like other banking trojans, it overlays fake screens on top of legitimate banking apps to capture login credentials and one-time passwords. What's different is that RedHat sends a screenshot of whatever is on screen to an AI assistant, which reads the layout and tells the malware where to tap next.
Older banking trojans rely on hard-coded coordinates for buttons and fields, so a bank redesigning its app can break the attack overnight. An AI that reads the screen like a person does sidesteps that problem, and Zimperium says it also makes the malware's behavior harder for security software trained to spot scripted automation to catch. RedHat fights back once installed too: it can reinstall components a victim deletes and intercept uninstall attempts, showing a fake error message instead of actually removing itself.
It is a preview of what happens when malware authors get the same agentic tooling being sold to everyone else as a productivity boost.