<![CDATA[RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall]]>

<![CDATA[RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall]]>Researchers have flagged a new Android malware family called RatHat, assessed to be operated by China-based threat actors. The malware stands out for its use of an AI-powered system to navigate and control compromised devices, and for a persistence trick that lets it keep shell access even after the user uninstalls it.

Distribution is handled primarily through targeted smishing (SMS/text phishing) and malvertising campaigns. These lures lead victims to deceptive third-party download portals, where the malicious app is sideloaded outside of official app stores.

The most notable capability is abuse of ADB (Android Debug Bridge). By leveraging ADB, RatHat is able to retain shell access on the device after the app itself has been removed, undermining the common assumption that uninstalling a malicious app fully remediates an infection.

Key points:

Malware family: RatHat
Attribution: assessed as operated by China-based threat actors
Notable features: AI-powered device navigation and control; ADB abuse for post-uninstall shell access
Distribution: smishing and malvertising, funneling victims to third-party download portals

Since the source material does not provide specific CVE IDs, KB numbers, or advisory identifiers, none are listed here.

Source: The Hacker News
Does your organization restrict sideloading and third-party app portals on managed Android devices, and how are you handling post-uninstall persistence risks like this?

]]>https://xploitlk.com/topic/375/rathat-android-malware-abuses-adb-to-retain-shell-access-after-uninstallRSS for NodeTue, 27 Oct 2026 08:51:26 GMTFri, 18 Sep 2026 06:30:19 GMT60