Learn
active
RatHat Android Malware Uses ADB for Persistence After Uninstall
- Engineer — Learn: The ADB-based persistence mechanism — retaining shell access after the app is removed — is a novel technique worth understanding for Android MDM/BYOD posture reviews, but there are no enrichment signals and no cloud/infra surface to patch today.
- SOC/IR — Learn: No IOCs or ATT&CK-mapped detections are provided, so there is nothing to hunt immediately; the smishing delivery chain and ADB persistence behavior are worth filing for future Android/BYOD detection coverage if your estate includes managed Android endpoints.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.