New Android RAT uses worm to target exposed ADB services
A new Android malware uses a worm to find and infect phones with open ADB ports. Attackers can then run malicious code remotely.
- Report priority
- Medium
- Targets
- Android
How it works
- The malware starts by scanning for Android phones with their ADB (Android Debug Bridge) ports left open.
- When it finds one, it sends a hidden installer that secretly loads a remote access tool (RAT) onto the phone.
- Once installed, the RAT lets attackers control the phone, stealing data, recording calls, or even turning on the camera without your knowledge.
What to do
Check if your phone has ADB enabled by opening a terminal or command prompt and running adb devices. If it shows a device listed, your ADB port is exposed. If you didn't intentionally leave it open, close it immediately by disabling USB debugging in Settings > Developer Options. If you see an unknown app installed recently or notice unusual behavior like battery drain or strange notifications, disable ADB immediately by turning off USB debugging in your phone's Developer Options.
If you suspect your phone is infected, factory reset it and restore only trusted backups. Check for unknown apps and remove them. If you used ADB for development, ensure it's only enabled when actively needed and never left open.
Technical details
The RAT employs a concealed loader and a worm that actively scans for exposed Android Debug Bridge (ADB) services to install itself on vulnerable devices.