RatHat: Accessibility Service Abuse to Enable ADB Wireless Debugging

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects execution of commands used to modify critical Android system settings, such as enabling accessibility services, developer options, or wireless debugging. These commands are commonly associated with the use of the Android Debug Bridge (ADB) to facilitate unauthorized device control, persistence, or configuration changes indicative of malicious activity or post-exploitation.