Researchers at Cleafy found that the RatHat Android banking trojan, sold as malware-as-a-service with nearly 100 console deployments tracked since April 2026, sends stolen text messages and banking credentials captured via fake login overlays to Google’s Gemini model, which estimates each infected victim’s bank balance. Operators use the resulting high- and mid-value rankings to decide which compromised phones are worth their time. A separate analysis found the malware also submits a phone’s on-screen content to Gemini to help it navigate different banking apps and Android versions automatically.