Rat Hat Android Malware Abuses ADB to Retain Shell Access After Uninstall
Summary: Researchers at Zimperium flagged a new Android malware called RatHat, assessed to be operated by China-based threat actors, that spreads through smishing, malvertising, and third-party download portals and abuses Accessibility permissions plus autonomous local ADB self-pairing to break out of the Android app sandbox. The malware uses a Go Agent disguised as "liblocal-service.so" and an FRP reverse-proxy client to hold a persistent C2 tunnel, and it retains shell access even after the victim uninstalls the app, reinstalling itself if it is not found.
Key Takeaway: Uninstalling the app does not remove the attacker: the ADB shell access persists and the malware can reinstall itself, so a device cleaned the usual way may still be under operator control. RatHat also collects SMS, credentials, files, lock screen PIN, pattern or password, screen captures, keystrokes, and a list of installed applications, with a hardware-level keylogger recording finger presses on screen.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026