RatHat Repeats a Wireless Debugging Trick Android Already Saw

RatHat Android malware, documented by Zimperium zLabs on September 16, 2026, turns on Wireless Debugging after one Accessibility grant and gives itself a shell.

Three families have used that path this year. The chatbot in RatHat is how it finds the next button. Lasting access comes from Android Debug Bridge, a Go agent that outlives the icon, and a reverse tunnel that keeps the phone on a private line.

One Accessibility Grant Runs the Whole Phone

Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega at Zimperium zLabs describe a dropper that arrives through smishing texts, bought ads, and third-party forums, then asks the user to sideload an APK. One build hides behind a streaming-app icon. The package can later restyle itself as Chrome through activity aliases, which is why a phone that already has Chrome still gets a “reinstall” prompt.

The lure for Accessibility is local. A file named svc_config.html tells some users the permission is needed “due to network restrictions” and sweetens the ask with financial bait. Sav Wheeler, a research engineer at Malwarebytes, put the human step in plain terms.

That sort of infection chain isn’t necessarily more complex than, say, following a phishing email on Windows and saying yes when the program asks for administrator permissions.

Sav Wheeler, research engineer, Malwarebytes, in an email

Once that toggle is on, SystemHelperService starts tapping. It is not root. It is the Settings app, driven by synthetic gestures, opening a developer door Google ships on every phone.

THE TAP CHAIN AFTER ACCESSIBILITY

• Build number: The service opens About phone and taps Build number 7 times to unlock Developer options.
• Wireless debugging: It opens that screen and flips the switch that was meant for app testers on Wi-Fi.
• Pairing scrape: It reads the 6-digit code and the live port off the dialog, scanning every TextView if resource IDs are missing.
• Local pair: An embedded ADB library authenticates to the daemon on the same handset, with no USB cable and no second computer.
• Stage the daemons: Shell access writes a Go agent and a reverse-proxy binary into /data/local/tmp and starts them.

zLabs calls that breakout autonomous local ADB self-pairing. Google’s own developer pages tell workstation owners they must pair using a pairing code that the phone shows on screen. RatHat treats that dialog as a form to scrape, then talks to adbd as if it were a laptop on the same Wi-Fi.

ToxicPanda and RedHook Already Flipped the Same Switch

Wireless debugging over Wi-Fi landed in Android 11 as a way to push builds without a cable. In July 2026, Group-IB described RedHook using Accessibility to enable Developer options, turn on Wireless Debugging, read the pairing code, and connect to the local daemon. That path yields shell user UID 2000, which is stronger than a normal app and still not root.

On August 19, 2026, the same zLabs bench published ToxicPanda 2.0. That write-up walks through automated Wireless Debugging pairing in five phases: seven taps on Build number, a toggle of Wireless debugging, a scrape of the 6-digit SPAKE2 pin and port, a local pair to 127.0.0.1, then shell commands that skip ordinary permission prompts. 28 days later, RatHat used the same first moves.

THREE FAMILIES, ONE DEBUGGING SWITCH

ToxicPanda 2.0 also harvests lock PINs through overlays on more than 140 banking and crypto apps. RatHat did not invent the debugging trick. It inherited a playbook that already worked on unrooted phones, then spent its novelty on what happens after the shell exists.

How RatHat Uses a Chatbot to Tap Settings

RatHat serializes the live Accessibility tree to XML and sends it to one of the world’s most popular generative AI assistants, zLabs said, with prompts that point to operators who work in Chinese. The model is asked for JSON coordinates of a named control, for the on-screen text of a node, and for navigation orders such as SCROLL_DOWN. That is why two infected phones can tap through Settings along slightly different paths when a vendor has moved a menu.

The assistant is a remote lookup, not an on-device brain, and zLabs did not name the vendor. Signature tools that look for a fixed click script will miss a run that asked a chatbot where Wireless debugging sits today. Wheeler’s other point still holds: Android escalation often means the user granted a permission the OS had locked away, and the model is only driving the taps that permission already allows.

Practitioners who read the first wave of write-ups kept separating those jobs. The chatbot makes automation less brittle when a skin or a language pack rearranges Settings. It does not create the shell. The pairing does. A sideloaded APK on stock Android cannot read the touch driver; UID 2000 can, which is the reason the family bothers with the 6-digit dialog at all.

The Go Agent Outlives the Uninstall Button

After the pair, the APK drops liblocal-service.so, a Go agent, into /data/local/tmp and starts an HTTP listener on 127.0.0.1:7910. From that shell context the agent can whitelist the app in Doze, force its standby bucket to active, disable other packages, and uninstall them. Those commands live in the Go binary, not in the APK’s DEX, so they are easy to miss if you only unpack the visible app.

The third piece, libmedia_codec.so, is a renamed Fast Reverse Proxy client. Staged as /data/local/tmp/frpc, it builds a reverse tunnel using an address, port, and token the agent fetches from the operators. frp is a normal open-source tool for exposing a box behind NAT. Here it turns the phone’s own ADB daemon into a line the operator can keep using even when the launcher icon is gone.

If you tap Uninstall, the app can cancel the confirmation and flash a fake Google Play error. It can also ask for Device admin, which lets it wipe the handset if you push the fight. Even a clean uninstall does not kill local-service. The agent checks whether the package is still present and, if it is not, runs pm install against a copy in /data/local/tmp, then writes enabled_accessibility_services and accessibility_enabled back into secure settings without another tap. While the app is still there, a heartbeat respawns the agent, rescans the ADB port ladder, and turns debugging back on if someone flipped it off.

Wheeler said static analysis and quarantining cannot finish the job, because the program remasquerades as other apps and changes its behavior through the AI endpoint. Malwarebytes can flag the family on a scan. Clearing the icon is not the same as proving the shell is gone, which is the distinction enterprise recovery has to make before a device is marked clean.

Raw Touch Coordinates Beat Screen Protections

RatHat logs typing three ways. UniversalInputMonitor watches Accessibility text-change events and rebuilds masked password fields from dots. KeystrokeCapture reads URL bars by resource id in Chrome, Brave, Opera, Edge, DuckDuckGo, Samsung Internet, and stock AOSP and ColorOS browsers. The third path is the one a normal app cannot take.

AdbTouchCapture, running in the Go agent, calls getevent against /dev/input. The kernel line is only a timestamp and a pair of coordinates, the sort of record that looks like EV_ABS ABS_MT_POSITION_X 0000021c and a matching Y, then SYN_REPORT. zLabs’ example maps a touch at (540, 1624) onto a Samsung PIN pad and gets 5. A file named locateValues.json stores keypad geometry per brand, and Point and DotAlign classes map a stroke onto the 3×3 pattern grid. Recovered secrets are tagged PASSWORD_QUALITY_TOUCH_POINTS so the operators know the value came from geometry, not from text.

FLAG_SECURE can block screenshots and Accessibility reads; it does not touch the input driver. A custom keyboard that never hands characters to the system still has to hit the glass. The lock screen hides PIN digits from Accessibility on purpose, and the coordinates still land. That is why the family spends so much work on Wireless Debugging: the prize is a uid that can open /dev/input, not a prettier overlay.

The APK still does the older jobs. MediaProjection can stream the display. An SMS receiver and a notification listener catch one-time codes. HTML injections sit over banking and crypto apps when those packages come to the foreground. None of that needs a shell. The driver-level PIN theft does.

WeChat, Alipay, and the 162 Sideloaded Apps

zLabs says the operators appear to work from China. WeChat and Alipay PIN overlays are embedded in the APK rather than fetched live. Other bank and crypto skins arrive as HTML tied to the foreground package. Researchers have counted 162 infected apps in the wild, talking to a dozen attacker servers.

WHAT RESEARCHERS HAVE COUNTED

• 162 apps: Sideloaded packages using the RatHat payload, found so far in the wild.
• A dozen servers: Command nodes those apps report back to.
• 61MB manifest: AndroidManifest.xml padded so that about 99 percent is undocumented 0x9999 chunks parsers choke on.
• Four plus one: Four anti-analysis layers in the package, and six separate runtime checks against debuggers, Frida, Xposed, root, and emulators.

The app registers over HTTP, then holds a WebSocket with HMAC-SHA256 on a per-device key. Endpoints take overlay logins, SMS bodies, the app list, lock-screen material, ADB certificates, the live debugging port, screen video, and tunnel config. The agent has its own task queue, including an offline cache that runs buffered jobs when the phone reconnects. A separate API can tell the Accessibility engine to go quiet on packages the operators want to avoid, without shipping a new build.

Droppers unpack two encrypted assets with a short XOR, then load stage 2 in memory. The ZIP lies about directories and encryption bits so that Android’s libziparchive accepts the file while apktool and unzip stumble. DEX code plants pseudo-instructions with a bad element_width that ART never runs and disassemblers try to measure. Strings go through StringFog and a second swap-and-XOR scheme. The point of that pile is not elegance. It is to make automated pipelines time out before anyone sees SystemHelperService.

Restricted Settings Did Not Stop the Dropper

Android 13 already tries to keep sideloaded apps away from Accessibility. Harmful apps, Google’s help page says, may ask you to change settings that put the device at risk, and those settings stay blocked until you allow restricted settings for an app from its App info screen. RatHat’s dropper uses native SessionInstaller APIs so that path does not bind the same way, and the payload can still reach the protected toggles after a user has been talked into the first grant.

THE WIRELESS DEBUGGING TIMELINE

1. Android 11: Wireless debugging over Wi-Fi ships so developers can pair a workstation with a 6-digit code and skip USB.
2. Android 13: Restricted settings start blocking sideloaded apps from Accessibility and device admin until the owner allows them per app.
3. July 2026: Group-IB describes RedHook enabling that debugging stack through Accessibility and taking shell UID 2000.
4. August 19, 2026: Zimperium documents ToxicPanda 2.0 repeating the 7-tap pair and aiming overlays at 349 financial apps.
5. September 16, 2026: Zimperium publishes RatHat, the same pair plus a chatbot navigator and daemons that reinstall the app.

Wheeler said smishing is written per target, so two people will not see the same text, and the bait shifts by region. The choke points do not. A link from an unknown SMS is still a stop. A page with an address bar is a website, not Play. Chrome that is already on the phone does not need a fresh APK. Developer options and Wireless debugging should stay off when you are not flashing builds. An Accessibility ask from a streaming clone is the last line, and it is the one this family cannot skip.

zLabs posted indicators for the family. A factory reset is the cleanup that removes the hidden files a scanner cannot quarantine. Until those files are gone, a deleted icon is not a clean phone.