GenAI-Powered ‘RatHat’ Android Malware Bypasses App Sandboxes via ADB

What Are the Key Technical Mechanics?

RatHat operates through a multi-stage execution pipeline designed to break standard Android process isolation constraints:

1. Accessibility-Assisted ADB Pairing: Once granted basic Accessibility permissions, RatHat uses automated synthetic taps to navigate device settings. It taps the Android “Build Number” seven times to unlock Developer Options, activates Wireless Debugging, and automatically scrapes the dynamic 6-digit ADB pairing code and port number directly from the screen.

2. Local Shell Execution & Sandbox Evasion: Using an embedded ADB client, RatHat pairs locally with the device’s own ADB daemon. This grants the threat actors an independent, high-privilege `ADB shell` execution context—entirely breaking out of the standard Android application sandbox without requiring a physical USB connection or host computer.

3. Generative AI UI Automation Engine: RatHat serializes the infected device’s live Accessibility UI tree into XML and streams key UI components to an external Generative AI endpoint. The AI acts as an autonomous UI navigator, returning screen coordinates and navigation instructions (e.g., `SCROLL_DOWN`, dynamic element identification) in real-time, rendering hardcoded automation scripts obsolete.

4. Out-of-Lifecycle Persistence: Armed with shell access, the malware drops native Go-compiled daemons (`liblocal-service.so` and `libmedia_codec.so`) into `/data/local/tmp`. Because these daemons run directly in the background OS layer, they operate outside the standard Android package lifecycle—allowing the malware to silently reinstall itself if the victim attempts an app uninstall.

What Is the Impact on Users?

• Hardware-Level Credential Theft: RatHat bypasses standard screenshot restrictions and custom keyboards by intercepting raw touch input events (`/dev/input`) at the kernel level, mapping finger tap coordinates against pre-configured device screen layouts to reconstruct lock-screen PINs and pattern locks.
• Financial & 2FA Hijacking: The malware injects fraudulent HTML overlays over banking and cryptocurrency applications while intercepting incoming SMS messages and system notifications to capture One-Time Passwords (OTPs).
• Resilient C2 Tunneling: By establishing a Fast Reverse Proxy (FRP) client tunnel via ADB shell privileges, attackers maintain an interactive, persistent gateway to the infected endpoint regardless of network changes.

What Should You Do? (Actionable Defense Steps)

1.  Disable Developer Options & Wireless Debugging: Ensure Developer Options and Wireless Debugging remain strictly toggled off on all fleet devices when not actively engaged in software development.
2. Audit Accessibility Grants: Enterprise Mobile Device Management (MDM) policies should continuously monitor and restrict non-essential applications requesting Accessibility Service permissions.
3.  Enforce Sideloading Restrictions: Block user-initiated APK side-loading from third-party sites, malvertising banners, or untrusted messaging links.
4.  Monitor Network Traffic for Local ADB Port Activity: Endpoint security tools should flag unexpected loopback network traffic targeting local ADB ports (`5555` or dynamic ADB pairing ports).

RatHat Technical Component Matrix