RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Researchers have identified a new Android malware called RatHat, believed to be operated by China-based threat actors, which utilizes an artificial intelligence-powered system to control compromised devices. RatHat is primarily distributed through targeted smishing and malvertising campaigns that lead to deceptive download portals. The malware is capable of abusing Android Debug Bridge to maintain shell access even after it has been uninstalled from a device.