Emerging ThreatsMalware & Ransomware

RatHat Malware Exploits ADB to Maintain Shell Access on Android Devices

Analyst 207||Source: TheHackerNews
Smartphone on cluttered desk with blank screen and nearby laptop.

"The malware serializes the device's live Accessibility tree to XML and communicates with one of the world's most popular Generative AI assistants," Zimperium said.

How RatHat breaks out of the Android sandbox

Security researchers at Zimperium — Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega — describe a multi-stage Android threat, dubbed RatHat, that combines Accessibility abuse with automated local ADB (Android Debug Bridge) self-pairing to gain shell-level privileges. The malicious Android application acquires Accessibility permissions and then abuses them to unlock Developer Options, enable Wireless Debugging, and extract the six-digit ADB pairing code. Once paired, RatHat stages independent native daemons that run with shell privileges and operate outside the normal application lifecycle, allowing attackers to maintain access even if the visible app is removed.

Four built-in anti-analysis techniques

  • Container tampering — the malware declares certain files as directories or sets the ZIP general-purpose encryption bit so Android's libziparchive ignores them while other tools like unzip and apktool do not.
  • Manifest bomb — undocumented 0x9999 chunk headers are placed in AndroidManifest.xml to crash or time out automated analysis pipelines while being skipped by the Android native runtime.
  • DEX bytecode poisoning — pseudo-instructions include an invalid element_width attribute to cause disassembly to fail.
  • Dual string-encryption — a scheme called StringCrypto: Base64 is used to resist analysis.

Three-part architecture: Android app, Go Agent, and FRP reverse-proxy

RatHat's runtime consists of a malicious Android app that acts as a conduit to obtain system permissions, a Go Agent masquerading as a native library named "liblocal-service.so," and an FRP client used to create a reverse tunnel to a command-and-control (C2) server. The Go Agent leverages the shell access achieved through the local ADB daemon to execute commands, establish persistence, and apply power management exemptions. The FRP client retrieves tunnel configuration from the C2 and establishes a persistent reverse tunnel to the operator, granting remote access to the device's ADB daemon independent of the app's own features.

Capabilities available to operators via the C2 and local services

Zimperium's analysis lists a broad set of commands and data the operators can request through the C2 and the local ADB-accessible services. Those capabilities include collecting SMS messages, harvesting credentials and files, extracting lock-screen PINs, patterns, or passwords, taking screen captures, capturing keystrokes (including browser address-bar entries), and enumerating installed applications. The Go Agent also contains a hardware-level keylogger that can record finger presses on the screen. Separately, the Android component can deploy overlays atop specific apps to harvest credentials, record the screen via the MediaProjection API, intercept SMS messages, and display a fake failure overlay impersonating the Google Play Store to override installation attempts.

Distribution vector: smishing, malvertising, and deceptive download portals

RatHat is propagated primarily via targeted smishing (SMS/text phishing) and malvertising campaigns that direct victims to deceptive third‑party download portals and forums. The APKs served through those sites function as droppers for the main payload and contain the anti-analysis and anti-debug safeguards described above. Once installed, the dropper launches the Go Agent and the FRP client, and the overall infection pipeline is designed to automate navigation and device control — including synthetic clicks and navigation actions resolved via a connected Generative AI assistant.

What this means for technologists, enterprises, and end users

  • Technologists and security teams: Zimperium warns that "traditional, signature-based mobile security controls are insufficient" given RatHat's use of out-of-lifecycle daemons, ADB-based shell access, and real-time GenAI decision loops. Teams will need telemetry that can detect unexpected ADB daemons, long-lived native services, and reverse tunnels originating from endpoints.
  • Enterprises and procurement leaders: RatHat's ability to harvest credentials, SMS messages, lock-screen secrets, and installed-app lists — and to persist after app uninstall via local daemons and the FRP tunnel — raises exposure for corporate devices used for privileged access or multi-factor recovery flows.
  • End users and the general public: The campaign uses smishing, malvertising, and deceptive third-party portals to lure installs, and uninstalling the visible app does not necessarily remove attacker shell access, because the local service can check for the malware and re-install it if not found.

RatHat's combination of Accessibility exploitation, automated ADB pairing, a disguised Go Agent, and a reverse-proxy channel builds a persistent, feature-rich foothold that survives simple removal. The detailed behavior Zimperium documents — from manifest bombs and bytecode poisoning to a Generative AI feedback loop that resolves screen coordinates and on-screen text — shows a deliberate effort to evade analysis and automate control. The practical question left by these facts is concrete: which detection points — local ADB pairing activity, unexpected native daemons, or outbound FRP tunnels — defenders will prioritize first to stop access that remains after uninstall.

https://thehackernews.com/2026/09/rathat-android-malware-abuses-adb-to.html

Emerging ThreatsGenerative AiMobile SecurityMalware OperationsAndroid MalwareRathatAccessibility AbuseADB
Related Intelligence

Continue Reading

Rows of network equipment and servers in a data center aisle with a central Cisco-like device.

Cisco Discloses Second Actively Exploited Zero-Day Vulnerability

Cisco has disclosed a second actively exploited zero-day vulnerability, CVE-2026-76460, a maximum-severity flaw in its Identity Services Engine (ISE) that lets attackers bypass authentication and take full control of affected devices. This vulnerability is particularly alarming because it allows hackers to modify network access policies, extract sensitive credentials, and move undetected across the network.

Analyst 207
Person sitting on a couch, staring at a laptop with concern.

Iran-Linked Malware Exploits Telegram for Password Theft

Meet HEAVYGRAM, a sneaky Telegram backdoor linked to Iran that's packed with espionage capabilities, from snapping screenshots to siphoning off sensitive data, and controlled remotely by its masters. This malicious tool has been quietly lurking in the shadows since September 2023, leaving a trail of compromised systems in its wake.

Analyst 207
Networked workstation with laptop and industrial equipment in a brightly-lit setting.

AI Agents Expose New Attack Vectors

A shocking 230 out of 243 unauthenticated LocalAI instances were found to be vulnerable to exploitation, highlighting a disturbing trend: our increasing reliance on convenient tools is creating new avenues for old security mistakes. This alarming vulnerability was recently exploited in a large-scale campaign, compromising high-value targets, including infrastructure linked to the Thai military.

Analyst 207
Laptop on a clean workbench in a modern office with a blank, gradient laptop screen.

AI Coding Agents Expose Zero-Click Flaw

A newly discovered vulnerability, dubbed Plugin4Shell, allows attackers to execute remote code with just a single click - or none at all - giving them carte blanche access to sensitive data and assets. This zero-click flaw in AI coding agents highlights the urgent need for updated security measures to prevent devastating supply-chain attacks.

Analyst 207