DNS Analysis: AI-Powered RatHat Smishing Campaign
Zimperium’s zLabs team¹ uncovered RatHat, an Android malware strain linked to threat actors that appear to be operating in China. It spreads through smishing and malvertising. Once installed, it abuses Accessibility permissions to gain shell-level access and steal banking credentials, PINs, and one-time passcodes.
The original analysis published 20 network IoCs — 15 subdomains and five domains. We extracted 14 more apex domains from the subdomains, then used the WhoisXML API MCP Server² to screen them, which flagged one as likely legitimate. That left 33 IoCs for our investigation into their WHOIS records, DNS history, hosting infrastructure, and connected artifacts.
Original IoCs Analyzed
Subdomains and domains from the reported campaign
Key Findings
Email-connected domains
Additional IP addresses
IP-connected domains
Malicious artifacts
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Subdomain expansion and domain IoC legitimacy check
- Domain IoC WHOIS and DNS history analysis
- Client traffic and typosquatting analysis
- Email-connected domain discovery
- IP geolocation and IP-connected domain discovery
- String-connected domain discovery
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://zimperium.com/blog/rathat-ai-powered-mobile-threat-is-here-for-your-credentials-bank-accounts
- [2] https://main.whoisxmlapi.com/ai/mcp-server
Latest Reports
Integrity Technology Group-Backed Actors Combine Automated and Manual Tools in Global Attack
WhoisXML API uncovered 7,100+ additional artifacts linked to the Integrity Tech-enabled global data theft attack. Download the threat research materials now.
Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
WhoisXML API uncovered 400+ additional artifacts linked to Earth Sirrush. Download the threat research materials now.
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.