RatHat Android malware keeps shell access after uninstall

Android malware called RatHat can hold on to a phone even after the app is deleted, according to research from the mobile security company Zimperium. The firm's researchers, Gianluca Braga, Vishnu Pratapagiri and Fernando Ortega, describe malware that is assessed to be operated by China-based threat actors and that includes an artificial intelligence system to navigate and control compromised devices. What makes the case stand out is the trick that keeps the intruder inside: RatHat abuses ADB, the Android Debug Bridge, the standard debugging tool that lets a computer talk to an Android phone, so a hidden service can stay connected after the visible app is gone.

The malware reaches victims through targeted smishing, the technical name for text message phishing, and through malvertising, meaning malicious advertising, both of which lead to deceptive third party download portals. Zimperium also names third party forums as a distribution channel. In every case the goal is the same: to persuade someone to install an APK, the installation file format Android uses, that carries the malware. Those packages work as a dropper, a small first stage whose only job is to launch the real payload, and they include layers of anti analysis and anti debug checks meant to keep them from being spotted.

Zimperium lists four anti analysis techniques built into those packages. Container tampering declares certain files to be directories, or sets the ZIP general purpose encryption bit flag on them, so that Android's own libziparchive library ignores those files while other tools such as unzip and apktool still see them. A manifest bomb inserts undocumented 0x9999 chunk headers into AndroidManifest.xml, the file that describes an app to the operating system; Android's native runtime skips the extra data, but automated analysis pipelines crash or time out on it. DEX bytecode poisoning adds pseudo instructions configured with an invalid element_width attribute, which makes the disassembly process fail. Dual string encryption relies on a scheme the researchers call StringCrypto: Base64 to resist analysis.

RatHat's architecture has three main components: the malicious Android application, a Go Agent, and an FRP reverse proxy client. The Android app is the entry point. It acts as a conduit to acquire critical system permissions and start the next phase, first obtaining accessibility services permissions, the Android features intended to help people with disabilities operate their phones but powerful enough to read and act on what is on screen, and then abusing that access to unlock Developer Options, switch on Wireless Debugging and extract the six digit ADB pairing code that authorises a debugging connection to the device.

Once running, the malware serves overlays on top of specific apps to harvest login credentials, records the screen through Android's MediaProjection API, intercepts SMS messages, and blocks installation attempts by displaying a fake failure overlay that impersonates the Google Play Store. Even if the victim manages to uninstall it, the attacker retains shell access, that is, the ability to run commands on the device, and Zimperium says the attacker can weaponise a local service to check whether the malware is still installed and reinstall it if it is not found.

The Go Agent executed by the APK masquerades as a native library named liblocal-service.so, but uses the shell access obtained through the local ADB daemon to run commands, which lets the malware establish persistence and apply power management exemptions so the system is less likely to shut it down. The FRP client, for its part, opens a secure reverse tunnel to a command and control server, the remote server an attacker uses to manage infected machines. A reverse tunnel is an outbound connection from the phone that stays open, letting the operator reach in.

As Zimperium describes it, the Go Agent retrieves the FRP tunnel configuration from the command and control server, enabling the FRP client to establish a persistent, active reverse tunnel to the operator. That connection gives the attackers access to the ADB daemon, which the researchers characterise as a general purpose road into the device that can carry whatever the operator wants, independently of the malware's own feature set. The commands sent from the server are varied and feature rich: collecting SMS messages, credentials, files, the lock screen PIN, pattern or password, screen captures, keystrokes including URLs typed into a browser's address bar, and the list of installed applications. RatHat also carries a hardware level keylogger, run by the Go Agent, that can record finger presses on the screen.

The artificial intelligence element works on top of those capabilities. According to Zimperium, the malware serialises the device's live Accessibility tree, the internal map of everything currently shown on screen, into XML and sends it to one of the world's most popular generative AI assistants. The researchers say the AI is used for non malicious actions: resolving the centre coordinates of a named target on screen as JSON so synthetic taps can be directed at it, resolving a target's actual on screen text from the XML, and signalling automatic navigation commands such as SCROLL_DOWN.

Zimperium's conclusion is that RatHat's multi tiered architecture, its reliance on daemons that outlive the app lifecycle, and its use of real time generative AI decision loops illustrate why traditional, signature based mobile security controls are insufficient. For anyone who owns a phone or manages phones for a business, the practical message is that the visible app is not the whole infection: the protection that matters here is preventing the install in the first place and keeping Android's developer and debugging features out of reach of unknown software. The researchers have published their findings; they have not said that this threat has been patched or stopped. For businesses that want help hardening the phones and accounts their staff use for work, AEU-I, our security first IT, infrastructure and consulting service, covers exactly that kind of review, while the everyday checks above remain the ones that keep this particular malware out.