A five-minute Android checkup that blocks the permissions banking malware like RatHat depends on.
RatHat is banking malware that abuses Accessibility and Wireless Debugging to watch screens and steal two-factor codes.
Go to Settings, then Accessibility, then Downloaded or Installed apps. Turn off anything you don't recognize.
Review notification access, display over other apps, usage access and device admin apps. Revoke what you don't need.
In Developer options, turn off Wireless debugging. Then confirm Play Protect is scanning apps in the Play Store.
Android 16's Advanced Protection blocks unknown installs and restricts accessibility tools. Infected? Factory reset.
How to Find the Android Apps That Can See Your Screen, and Lock Them Out