A newly uncovered Android malware strain named RatHat is exploiting Android Debug Bridge (ADB) and Accessibility service abuses to retain control over devices—even after users uninstall the malicious app. Security researchers believe the malware originates from China-based actors and leverages artificial intelligence for autonomous operation.
How RatHat Operates
RatHat infiltrates devices through smishing (phishing via SMS), malicious advertising, and deceptive third-party forums that direct victims to fake download portals. What gets installed is usually a dropper APK: a lightweight app that unlocks deeper access with minimal detection. The malware contains multiple layers of defense against analysis—such as malformed manifest entries, corrupted DEX bytecode, and dual encryption of strings—that help it throw off automated sandboxes and reverse engineering tools.
After initial installation, RatHat uses the Android Accessibility service to gain elevated permissions. It then enables Wireless Debugging, retrieves the six-digit ADB pairing code, and pairs with the device. A malicious Go agent, disguised as a native library, works in concert with a reverse proxy client to reach shell-level privileges, execute native daemons, and maintain a command channel back to the attackers.
Persistence Post Uninstall & What Attackers Gain
One of RatHat’s most alarming features is its ability to survive even when the user removes the malicious app. A local ADB service periodically checks whether the app is still present and can reinstall the APK if it has been deleted. Because this service runs independently of the main app, it gives attackers ongoing access without needing the victim’s awareness.
Once in control through ADB, RatHat can perform a wide range of espionage and control: monitoring SMS messages, recording screens, harvesting credentials via overlays, capturing keystrokes including browser URLs, and locking or unlocking the device PIN or password. The malware even contains a hardware-level keylogger to record screen-touch inputs. All of this is orchestrated in part by integrating with a popular GenAI assistant that helps identify UI elements and automate navigation based on app layouts.
Communication with the attacker’s command-and-control (C2) infrastructure is maintained via an FRP reverse proxy. The Go agent fetches the configuration from the C2 server and establishes a persistent tunnel that runs independently from the owner app. Through that channel, commands are issued to extract data, override settings, and control the device deeply.
Why RatHat Is a Wake-Up Call
The malware demonstrates how conventional mobile security approaches—based on detecting known malware signatures or static analysis—are not enough. RatHat’s use of out-of-lifecycle daemons (tasks running outside of normal app contexts), dynamic GenAI-assisted decision loops, and ADB-level control allow it to evade many defenses. It brings together Accessibility abuse, local ADB self-pairing, native code execution, and cloud-based command structures in a coordinated attack chain.
Analytical Take: RatHat embodies a new class of Android threats—autonomous, adaptive, and deeply entrenched. For users, it means that uninstalling apps may no longer guarantee safety. For the security industry, it suggests the countermeasures must evolve: more runtime behavior monitoring, coordinated detection of abnormal ADB pairing and developer-options misuse, and tighter controls over Accessibility permissions. The stakes are higher, and what once seemed like paranoia around permissions abuse is now safely viewed as necessary vigilance.
