THost9 Android malware spreads via ADB
THost9 is a remote-access Trojan (RAT) for Android that hides its malicious code and spreads to other devices using ADB, a tool for managing Android phones. Attackers can take control of infected devices and move laterally to others on the same network.
- Report priority
- Medium
- Targets
- Android
How it works
- THost9 starts by hiding its malicious code inside a fake app or file.
- Once installed, it uses ADB (Android Debug Bridge), a tool for managing Android devices, to scan and infect other devices connected to the same network.
- ADB is usually used by developers, but attackers exploit it when it's left open on a device.
- This lets THost9 move from one phone to another without user interaction, spreading silently across a network of infected devices.
What to do
Check if ADB is enabled on your Android device by opening the Settings app, going to Developer options, and looking for 'USB debugging' or 'ADB debugging.' If it's turned, your device could be at risk. Also, verify if you've installed any apps from unknown sources or clicked suspicious links recently. If you see unusual behavior like unexpected app installations or network activity, immediately disable ADB by turning off 'USB debugging' in Developer options.
Uninstall any suspicious apps you've recently installed. Update your Android system to the latest version, as newer updates may include security patches. If you suspect your device is infected, factory reset it and restore only trusted backups. For further assistance, contact your device manufacturer's support team or a trusted IT professional.
Technical details
An attacker sends a fake app to a victim's phone via a phishing link. The victim installs it, unknowingly enabling ADB on their device. THost9 then scans the local network for other Android devices with ADB enabled and infects them automatically.
THost9 hides its payload and uses ADB to spread across exposed Android devices and containers