[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXsgyAz6rKlys6ds8998fRnZK4y_lgoVmxwdTHbf8Hvg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"3dc841e6-abcc-40d6-8fd4-78b96ae468a5","rathat-android-malware-persists-after-uninstall-via-adb-abuse","38797620-289f-45fa-9781-3aa1dd278581","RatHat Android Malware Persists After Uninstall via ADB Abuse","RatHat demonstrates a sophisticated escalation of Android-targeted threats by exploiting the Android Debug Bridge (ADB) and Accessibility Services to maintain persistent shell access even after the malicious app is removed by the user. The malware is delivered through smishing and malvertising, targeting users who may not recognize the social engineering tactics used to trick them into granting dangerous permissions. Once installed, it abuses legitimate Android features intended for developers and accessibility users, effectively bypassing sandboxing protections. This attack highlights that uninstalling a suspicious app is no longer a reliable remediation step, and that over-permissive device configurations dramatically expand the attack surface. The use of AI to autonomously control devices marks a dangerous evolution in mobile malware capability.","**Immediate actions:**\n- Disable Android Developer Options and ADB on all non-development devices, especially those used in corporate environments.\n- Educate users to avoid clicking links in unsolicited SMS messages or ads, and to only install apps from official, verified sources.\n- Review and revoke unnecessary Accessibility Service permissions on all managed mobile devices.\n\n**Long-term improvements:**\n- Deploy a Mobile Device Management (MDM) solution to enforce security baselines, restrict sideloading, and control permission grants at the enterprise level.\n- Implement Mobile Threat Defense (MTD) solutions capable of detecting ADB abuse, anomalous Accessibility Service usage, and persistent shell connections.\n- Establish a formal mobile app vetting and allowlisting policy to prevent unauthorized or unverified applications from running on corporate devices.\n\n**Detection measures:**\n- Enable logging and alerting for unusual Accessibility Service activations or ADB pairing events on managed endpoints.\n- Monitor network traffic from mobile devices for suspicious outbound connections indicative of command-and-control (C2) communication.\n- Conduct regular mobile security audits to identify devices with Developer Options or ADB enabled outside of approved use cases.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-124 Rev. 2 – Guidelines for Managing the Security of Mobile Devices","NIST AC-3 – Access Enforcement","NIST AC-17 – Remote Access","NIST SI-3 – Malicious Code Protection","NIST SA-10 – Developer Configuration Management","GDPR Article 32 – Security of Processing (for organizations handling personal data on mobile devices)","OWASP Mobile Top 10 – M1: Improper Platform Usage","OWASP Mobile Top 10 – M6: Insecure Authorization",{},"published","2026-09-18T08:20:53.705087+00:00","2026-09-18T08:20:53.42+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Frathat-android-malware-abuses-adb-to.html","rathat-android-malware-abuses-adb-to-retain-shell-access-after-uninstall-d52067","RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":46,"name":47,"slug":48,"description":49,"color":50},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[53,57,61],{"slug":54,"name":55,"problem":56},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":62,"name":63,"problem":64},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]