RatHat Android Malware Uses ADB for Persistence After Uninstall

Fri, 18 Sep 2026 14:58:07 +0000

Engineer — Learn: The ADB-based persistence mechanism — retaining shell access after the app is removed — is a novel technique worth understanding for Android MDM/BYOD posture reviews, but there are no enrichment signals and no cloud/infra surface to patch today.
SOC/IR — Learn: No IOCs or ATT&CK-mapped detections are provided, so there is nothing to hunt immediately; the smishing delivery chain and ADB persistence behavior are worth filing for future Android/BYOD detection coverage if your estate includes managed Android endpoints.
Leader — Skip

Adb-Abuse on CuraSec