RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
New Android malware RatHat uses ADB to maintain shell access post-uninstall.
RatHat is a new Android malware operated by China-based threat actors that leverages AI to control compromised devices. It uses Accessibility abuse and autonomous ADB pairing to escape sandboxing and maintain shell access even after uninstallation. The malware is distributed via smishing and malvertising, employing several anti-analysis techniques.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonRatHat demonstrates a sophisticated escalation of Android-targeted threats by exploiting the Android Debug Bridge (ADB) and Accessibility Services to maintain persistent shell access even after the malicious app is removed by the user. The malware is delivered through smishing and malvertising, targeting users who may not recognize the social engineering tactics used to trick them into granting dangerous permissions. Once installed, it abuses legitimate Android features intended for developers and accessibility users, effectively bypassing sandboxing protections. This attack highlights that uninstalling a suspicious app is no longer a reliable remediation step, and that over-permissive device configurations dramatically expand the attack surface. The use of AI to autonomously control devices marks a dangerous evolution in mobile malware capability.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.