RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
-
Researchers have flagged a new Android malware family called RatHat, assessed to be operated by China-based threat actors. The malware stands out for its use of an AI-powered system to navigate and control compromised devices, and for a persistence trick that lets it keep shell access even after the user uninstalls it.
Distribution is handled primarily through targeted smishing (SMS/text phishing) and malvertising campaigns. These lures lead victims to deceptive third-party download portals, where the malicious app is sideloaded outside of official app stores.
The most notable capability is abuse of ADB (Android Debug Bridge). By leveraging ADB, RatHat is able to retain shell access on the device after the app itself has been removed, undermining the common assumption that uninstalling a malicious app fully remediates an infection.
Key points:
- Malware family: RatHat
- Attribution: assessed as operated by China-based threat actors
- Notable features: AI-powered device navigation and control; ADB abuse for post-uninstall shell access
- Distribution: smishing and malvertising, funneling victims to third-party download portals
Since the source material does not provide specific CVE IDs, KB numbers, or advisory identifiers, none are listed here.
Source: The Hacker News
Does your organization restrict sideloading and third-party app portals on managed Android devices, and how are you handling post-uninstall persistence risks like this?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login