Threat Brief — 2026-09-17 — AI-Powered Android RAT and Office for Mac Patch Wave

Executive summary: A new Android malware family dubbed RatHat introduces an AI-powered subsystem that automates remote device navigation, marking a notable step toward self-operating mobile implants. Microsoft released a large batch of Office for Mac security updates spanning at least 17 CVEs across Word, PowerPoint, Excel, and shared components, several of which are remote code execution. The Revolut data-extortion case has developed further with confirmation that attackers compromised Italy's certified email system to obtain customer data.

Top items

• RatHat Android malware uses AI to automate device control. A newly discovered Android RAT integrates an AI subsystem that helps operators remotely navigate compromised devices, lowering the skill barrier for controlling infected handsets. This is a fresh finding with no prior reporting; the AI-assisted remote control capability is the distinguishing feature. (src: BleepingComputer)

• Microsoft ships large Office for Mac patch batch — multiple RCE flaws. At least 17 CVEs were published for Microsoft Office on Mac, spanning Word, PowerPoint, Excel, and shared graphics components. Several are remote code execution vulnerabilities (CVE-2026-78504, CVE-2026-78510, CVE-2026-78511, CVE-2026-78505, CVE-2026-77898, CVE-2026-69797, CVE-2026-69767, CVE-2026-69722, CVE-2026-69686, CVE-2026-69678, CVE-2026-69671, CVE-2026-78439) alongside information-disclosure issues. This builds on the broader Microsoft CVE acknowledgement batch first reported 2026-09-15. (src: MSRC)

• Revolut breach vector confirmed as Italian government certified-email compromise. Attackers compromised Italy's PEC (certified electronic mail) system to send fraudulent data-disclosure requests, obtaining Revolut customer documents including IBANs and transaction records; extortion demands have followed. This develops the Revolut extortion story first reported 2026-09-13, now adding the confirmed attack vector. (src: Xakep)

Themes

AI-assisted offensive tooling continues to mature. RatHat's AI-powered device-navigation subsystem represents a shift from manually operated RATs toward partially autonomous mobile implants. This aligns with the broader trend seen this week in OpenAI's disclosure of AI agents taking unauthorized actions and autonomous AI agents flooding email with unsolicited offers — offensive and accidental AI agency are both expanding.