Inside a Packed Android RAT Loader
Hagaseca is a group of Android malware apps that secretly take over phones and tablets by exploiting unsecured Android Debug Bridge (ADB) connections. It hides malicious code inside fake apps, then uses your device's accessibility features to control it remotely, steal files, and even spread to other devices on your network.
- Report priority
- High
- Targets
- android rat+3 more
How it works
- The malware starts when you install a fake app that hides malicious code inside an APK file.
- Once installed, it loads a hidden program called tc9.dex that gives attackers full control over your device.
- The malware then looks for other devices on your local network that have ADB (Android Debug Bridge) turned on and unsecured.
- If it finds one, it automatically installs itself there too.
- Attackers also use a website called test.hagaseca.com to download extra malicious files that help them keep control of your device.
What to do
Check if you have ADB enabled on your Android device. Go to Settings, then look for Developer Options. If you see ADB enabled or an option to connect to a computer, it is likely exposed. If you notice unusual activity like unexpected network scans or apps running in the background, immediately disable ADB by going to Settings > Developer Options and turning off USB debugging or ADB access.
Update your Android device to the latest version, as the current version often patch security vulnerabilities. Remove any suspicious apps you've installed recently. If you suspect your device is infected, factory reset it and restore from a clean backup. Check your network for any unauthorized devices and secure your Wi-Fi to prevent further infections.
Technical details
Affected software: android rat, thost4, accessibility abuse, adb propagation
An attacker sends a fake app to a victim via a phishing email or malicious website. The victim installs the app, which secretly activates ADB on their device and connects to the attacker's command center. The malware then scans the victim's local network for other devices with ADB exposed, infecting them automatically. The attacker gains full remote access, including taking screenshots, recording keystrokes, and transferring files.
This vulnerability involves the Hagaseca malware cluster, specifically the THost9 RAT loader variant, which exploits exposed Android Debug Bridge (ADB) services to compromise Android devices. The malware hides executable code inside an APK, loading tc9.dex, a stage that grants shell access, file transfer, and ADB propagation. It spreads via unsecured ADB services, scanning entire /16 networks for vulnerable endpoints and installing itself on affected systems, including Redroid containers and Wi-Fi-exposed devices.
The loader uses XOR and gzip packing, persistence via foreground services, and accessibility features to maintain control. Additional payloads are fetched from test.hagaseca.com, enabling remote administration and worm-like propagation. Public incidents link this activity to exposed systems from October 2024 through 2026. No CVE ID or CVSS score is assigned, as this is a malware analysis rather than a traditional software vulnerability.