cyber.hendryadrian.com
Threat Research · zimperium.com

RatHat Android Malware Uses ADB Self-Pairing to Steal Credentials and Persist

· Original article ↗

Summary

Zimperium researchers describe RatHat, Android malware reportedly linked to China-based actors. It uses phishing and malvertising, Accessibility abuse, and local ADB self-pairing to gain shell access, steal credentials, and maintain control.

Key points

  • RatHat is distributed through smishing, malvertising, and deceptive download portals that deliver malicious APKs.
  • The malware uses Accessibility features to enable wireless debugging, collect ADB pairing details, and pair with the device’s local ADB daemon for shell-level access.
  • It steals banking and payment credentials, intercepts OTPs, and uses raw touch coordinates to reconstruct PINs, passwords, and unlock patterns.
  • A Go agent can persist outside the main app’s lifecycle, reinstall the app after removal, and maintain a reverse tunnel through an FRP client.
  • RatHat uses AI-assisted automation to interpret the device’s Accessibility interface and direct actions such as taps and scrolling.
  • Its anti-analysis measures include modified APK structures, poisoned DEX data, encrypted strings, and checks for debugging and analysis tools.

Article Details

Attack Vectors
  • RatHat is distributed through smishing, malvertising, and deceptive third-party download portals that lead users to download malicious APKs.
  • The malware uses Accessibility services and local ADB wireless-debugging self-pairing to obtain shell-level access to the device.
  • RatHat uses deceptive overlays and injected HTML to steal banking and payment credentials, and intercepts SMS messages and notifications for OTP/2FA codes.
  • It captures text through Accessibility events and reconstructs PINs, passwords, and unlock patterns from raw touch coordinates.
  • A Go agent and FRP client maintain access through a reverse tunnel to attacker-controlled C2 infrastructure; the article does not provide the C2 address.
Defensive Notes
  • Zimperium says its Mobile Threat Defense product detects RatHat’s dropper and payloads, monitors anomalous Accessibility and ADB activity, and can block malicious distribution domains and isolate C2 communications.
  • Zimperium says zDefend can detect fraudulent overlays, Accessibility scraping, screen-capture utilities, elevated debugging services, and unauthorized system manipulation.

MITRE ATT&CK

T1016 · System Network Configuration DiscoveryRatHat scrapes the wireless-debugging pairing code and dynamic port from the device interface.T1041 · Exfiltration Over C2 ChannelRatHat sends harvested credentials, messages, files, and screen data to its C2 channels.T1056.001 · KeyloggingIt reconstructs typed credentials from Accessibility text events and PINs or patterns from raw touch input.T1057 · Process DiscoveryOne anti-analysis check uses process-list output and searches for Frida-related processes.T1071.001 · Web ProtocolsRatHat communicates with C2 over HTTP and WebSocket connections.T1090.001 · Internal ProxyIts FRP client creates a reverse tunnel that exposes the device’s internal services to the operator.T1105 · Ingress Tool TransferThe APK stages and launches a Go agent and an FRP client on the device.T1113 · Screen CaptureThe malware captures screen data using MediaProjection and shell-level screen-monitoring tooling.T1204.002 · Malicious FileVictims manually download and install APKs disguised as legitimate apps.T1497.001 · System ChecksRatHat checks for emulator, root, Xposed, and debugging-related device properties.T1566.002 · Spearphishing LinkRatHat is distributed through smishing and phishing sites that lure victims to download malicious APKs.T1620 · Reflective Code LoadingThe dropper loads an in-memory DEX by reflection to unpack and install the payload.T1622 · Debugger EvasionThe malware checks for JDWP and ptrace debugging, Frida, and the FLAG_DEBUGGABLE setting.

Malware

RatHatRatHat is a novel Android malware linked to China-based threat actors that uses smishing, malvertising, Accessibility abuse, and local ADB self-pairing to gain shell-level control and persist on devices.

Vendors

Zimperium#RatHat

Products

AndroidRatHat is a novel Android malware linked to China-based threat actors that uses smishing, malvertising, Accessibility abuse, and local ADB self-pairing to gain shell-level control and persist on devices.Mobile Runtime Protection (zDefend)Both Zimperium’s Mobile Threat Defense (MTD) and Mobile Runtime Protection (zDefend) provide comprehensive zero-day coverage against RatHat across every stage of the attack chain.Mobile Threat DefenseBoth Zimperium’s Mobile Threat Defense (MTD) and Mobile Runtime Protection (zDefend) provide comprehensive zero-day coverage against RatHat across every stage of the attack chain.z9 engineZero-Day Malware Detection: Powered by the on-device z9 engine, MTD flags the dropper and secondary payloads without relying on cloud-tethered lookups or static signatures, not being affected by the bundle manipulation

Tools

frpc#RatHatgetevent[T1056.001 ] Input Capture: Keylogging – Reconstructs typed text from Accessibility events and raw input events (‘track beforeText, eventText…’ and ‘getevent’)minicap[Libraries / tooling names ] Embedded components and proxy tooling – libadb-android, frpc, minicap

Countries

ChinaRatHat is a novel Android malware linked to China-based threat actors that uses smishing, malvertising, Accessibility abuse, and local ADB self-pairing to gain shell-level control and persist on devices.

Industries

BankingIt steals banking and payment credentials, OTP/2FA codes, and lock-screen secrets while using AI-driven automation, covert tunnels, and self-restoring persistence to maintain access.

Related Articles