RatHat UniversalInputMonitor Accessibility Keylogger Activity

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•1

This rule detects potential keystroke logging activities on Android devices by monitoring the 'UniversalInputMonitor' accessibility service. This service is abused by the RatHat malware family and similar threats to capture user input, including passwords, PINs, and text entered into masked fields, by intercepting accessibility text events.