{"data":{"id":"8193bc64-dc82-4323-af0a-75b246d765a6","title":"RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims","summary":"Cleafy reports that RatHat's operators run an Android banking trojan through a web console, with nearly 100 deployments traced since April 2026. The latest console version asks Google's Gemini model to estimate each victim's bank balance from intercepted text messages and sorts phones into high-value and mid-value groups. Cleafy found no samples using the model to move money.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/09/rathat-android-malware-console-uses.html","publishedAt":"2026-09-28T17:38:33.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedVendors":["Google"],"affectedVendorsRaw":["Gemini"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-28T17:38:33.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}