RatHat MaaS Console Integrates Gemini for Victim Triage, Persists via ADB Shell

The core shift is not the trojan itself, which has remained stable since late 2025, but the replacement of the Fisher console with three successive builds that embed Gemini queries directly into the operator workflow. Cleafy samples show the model receives only message text and overlay credentials; its output drives automated sorting into high-value and mid-value queues. This removes manual review for low-balance targets and concentrates live operator time on the upper tier.

Zimperium's earlier reporting documented the initial infection vector via SMS and ads, while Cleafy added the post-install sequence: Accessibility abuse enables wireless debugging, extracts the pairing code, then spawns a Go binary reachable over reverse tunnel. That binary supplies minicap/minitouch streaming without permission prompts, surviving app deletion until reboot. Neither firm published a full remediation path, leaving the UID 2000 shell as an unaddressed persistence layer.

The pattern matches prior MaaS evolution seen in Cerberus and Alien deployments where operator consoles absorbed commodity AI for triage rather than execution. Official statements emphasize victim impact; the technical evidence shows a scalable filter that lowers the skill floor for new operators while increasing yield per compromised device. Android 14+ devices remain partially protected only because minicap fails, not because of any systemic change.

Expect rapid template reuse: the same Gemini integration and scheduled rebuild pipeline will likely appear in unrelated banking trojan consoles within six months as code leaks or affiliate sharing occurs.