Cleafy Says RATHat Operators Use Gemini to Rank Infected Android Phones by Bank Balance

Security researchers say the Android banking trojan RATHat has evolved into a malware-as-a-service operation whose Panda Workshop console uses Gemini to rank infected phones by estimated bank balance. Cleafy traced nearly 100 separate console deployments since April 2026 and said Gemini is being used both to keep device automation working and to help operators decide which victims are worth pursuing.