RatHat Android Malware Persists After Uninstall via ADB Abuse
RatHat demonstrates a sophisticated escalation of Android-targeted threats by exploiting the Android Debug Bridge (ADB) and Accessibility Services to maintain persistent shell access even after the malicious app is removed by the user. The malware is delivered through smishing and malvertising, targeting users who may not recognize the social engineering tactics used to trick them into granting dangerous permissions. Once installed, it abuses legitimate Android features intended for developers and accessibility users, effectively bypassing sandboxing protections. This attack highlights that uninstalling a suspicious app is no longer a reliable remediation step, and that over-permissive device configurations dramatically expand the attack surface. The use of AI to autonomously control devices marks a dangerous evolution in mobile malware capability.
Tactical Insight
Immediate actions
- Disable Android Developer Options and ADB on all non-development devices, especially those used in corporate environments.
- Educate users to avoid clicking links in unsolicited SMS messages or ads, and to only install apps from official, verified sources.
- Review and revoke unnecessary Accessibility Service permissions on all managed mobile devices.
Long-term improvements
- Deploy a Mobile Device Management (MDM) solution to enforce security baselines, restrict sideloading, and control permission grants at the enterprise level.
- Implement Mobile Threat Defense (MTD) solutions capable of detecting ADB abuse, anomalous Accessibility Service usage, and persistent shell connections.
- Establish a formal mobile app vetting and allowlisting policy to prevent unauthorized or unverified applications from running on corporate devices.
Detection measures
- Enable logging and alerting for unusual Accessibility Service activations or ADB pairing events on managed endpoints.
- Monitor network traffic from mobile devices for suspicious outbound connections indicative of command-and-control (C2) communication.
- Conduct regular mobile security audits to identify devices with Developer Options or ADB enabled outside of approved use cases.