RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

RatHat is a newly identified Android malware attributed to China-based threat actors that leverages AI to interact with compromised devices. It is distributed via smishing and malvertising campaigns leading to third-party download portals, where users are tricked into installing malicious APKs. The malware abuses Android Debug Bridge (ADB) to gain shell-level privileges and maintain persistence even after uninstallation by using a reverse tunnel via an FRP client to a C2 server. It can harvest credentials, record screens, intercept SMS, and log keystrokes, while using AI to dynamically navigate the device UI based on Accessibility tree data.

AI-extracted · verify before operational use