[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foFxP24eHRAjHpf6qsJu00cdFmamt4EJcHSEsUuC5YmY":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":121},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"38797620-289f-45fa-9781-3aa1dd278581","RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall","rathat-android-malware-abuses-adb-to-retain-shell-access-after-uninstall-d52067","Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. \"Distributed primarily via targeted smishing (SMS\u002Ftext phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses","RatHat is a new Android malware operated by China-based threat actors that leverages AI to control compromised devices. It uses Accessibility abuse and autonomous ADB pairing to escape sandboxing and maintain shell access even after uninstallation. The malware is distributed via smishing and malvertising, employing several anti-analysis techniques.","New Android malware RatHat uses ADB to maintain shell access post-uninstall.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Frathat-android-malware-abuses-adb-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj5Psm8tS3JWb6ev7nZoz7YQDPIgoHj9gwbNjgjxbokxICdzRIUb5YJI-XfDx0NQgm8afhayc-Zd51hjuxqi7Sk_XxCNXoTNt7nIZWpxCBcDMLjSm3uW38HRciOu3WNtaUT0a-2NSsOX91GbXpCScryNirImMMC4lkuVysHku58maTbm9XvAwJ0-X6O_wDE\u002Fs1600\u002F1000109602.jpg","2026-09-18T06:17:25+00:00","2026-09-18T08:00:11.803573+00:00",8,[17,20,23],{"name":18,"type":19},"China-based threat actors","threat_actor",{"name":21,"type":22},"Android Debug Bridge","technology",{"name":24,"type":22},"Generative AI","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":46,"vendors":120},[47,68,94],{"slug":48,"name":49,"problem":50,"products":51},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[52,60],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":69,"name":70,"problem":71,"products":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":90,"product_name":91,"url":92,"description":93},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":95,"name":96,"problem":97,"products":98},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[99,106,112],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":100,"product_name":103,"url":104,"description":105},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":107,"product_name":108,"url":110,"description":111},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":122,"title":123,"body":124,"framework_refs":125,"framework_notes":138},"rathat-android-malware-persists-after-uninstall-via-adb-abuse","RatHat Android Malware Persists After Uninstall via ADB Abuse","RatHat demonstrates a sophisticated escalation of Android-targeted threats by exploiting the Android Debug Bridge (ADB) and Accessibility Services to maintain persistent shell access even after the malicious app is removed by the user. The malware is delivered through smishing and malvertising, targeting users who may not recognize the social engineering tactics used to trick them into granting dangerous permissions. Once installed, it abuses legitimate Android features intended for developers and accessibility users, effectively bypassing sandboxing protections. This attack highlights that uninstalling a suspicious app is no longer a reliable remediation step, and that over-permissive device configurations dramatically expand the attack surface. The use of AI to autonomously control devices marks a dangerous evolution in mobile malware capability.",[126,127,128,129,130,131,132,133,134,135,136,137],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-124 Rev. 2 – Guidelines for Managing the Security of Mobile Devices","NIST AC-3 – Access Enforcement","NIST AC-17 – Remote Access","NIST SI-3 – Malicious Code Protection","NIST SA-10 – Developer Configuration Management","GDPR Article 32 – Security of Processing (for organizations handling personal data on mobile devices)","OWASP Mobile Top 10 – M1: Improper Platform Usage","OWASP Mobile Top 10 – M6: Insecure Authorization",{}]