New Android RAT uses worm to target exposed ADB services

A new Android remote access trojan (RAT), tracked as THost9 and part of the Hagaseca cluster, has been discovered by Dark Atlas researchers. The RAT employs a concealed loader and a worm that actively scans for exposed Android Debug Bridge (ADB) services to install itself on vulnerable devices, with further coverage provided by Infosecurity Magazine.The malware utilizes a packed loader that hides executable code within an Android application package, decoding it with a single-byte XOR operation and decompressing it with gzip before dynamically loading a second-stage payload. This payload, tc9.dex, provides capabilities such as shell execution, file transfers, tunneling, and reverse-shell access. A significant propagation feature is the ADB worm, which discovers ADB services, authenticates using prepared key material, and installs the malware.Incident reports link THost9 and an earlier variant, THost4, to infections on Android phones and Redroid containers with exposed ADB, dating from October 2024 through 2026. While scanning an ADB service doesn't automatically grant access, the recovered scanner directly connects infections to public ADB or Redroid exposure. Researchers recommend removing public ADB exposure and reviewing accessibility services and persistent Redroid data to mitigate risks.Infosecurity Magazine Source: Get daily email updates SC Media's daily must-read of the most current and pressing daily news Related Terms AdwareYou can skip this ad in 5 seconds