RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model

Cleafy research describes the RatHat Android banking trojan whose C2 panels evolved rapidly into a commercial-like MaaS platform (rebranded Panda Workshop) capable of building, signing and regenerating Android samples, managing operator accounts, deploying phishing pages, and pushing a native Go service for persistence and shell access; operators also used Google's Gemini LLM to score victims by estimated bank balance and to assist UI automation, and nearly 100 deployments were observed across multiple regions.