RatHat Autonomous Local ADB Self-Pairing Sandbox Escape

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects unauthorized programmatic invocation of ADB pair or connect commands by an Android application. This activity is indicative of the RatHat malware family attempting to abuse Accessibility Services and Wireless Debugging to self-pair with the local ADB daemon, thereby bypassing the Android application sandbox.