Loading story…
Researchers at Dark Atlas identified THost9, a packed Android remote-access trojan associated with the artifact-defined Hagaseca cluster. A concealed loader decodes and dynamically loads the tc9.dex second-stage payload, enabling remote shell access, command execution, file transfers, tunneling, reverse shells, and downloadable modules.
THost9 contains a worm that scans broad address ranges or uses supplied targets to find exposed Android Debug Bridge (ADB) services, then uses prepared ADB key material to authenticate and install itself on reachable Android devices and Redroid containers. Incident reporting has linked THost9 and the earlier THost4 variant to exposed-ADB infections from October 2024 through 2026; organizations should remove public ADB exposure and examine accessibility services and persistent Redroid data for compromise.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Dark Atlas resolved the command-and-control host used by THost9 and found it had recently continued accepting the loader's connection sequence.
During an analyst check, the THost9 command-and-control endpoint was still accepting the loader's connection sequence.
Following an infection, a Redroid deployment was rebound to localhost-only access as part of remediation.
Public incident reports linked THost9 and the earlier THost4 variant to infections of Android phones and Redroid containers exposed through Android Debug Bridge services, with reports spanning from October 2024 through 2026.
Dark Atlas identified THost9 as a packed Android RAT and designated the broader artifact-defined cluster Hagaseca based on shared namespaces, certificates, and class names. Researchers reported that its tc9.dex payload includes an ADB worm that authenticates to accessible exposed ADB services with prepared key material and installs the malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **RatHat**, an Android banking trojan and remote-access tool tentatively linked to China-based operators. Distributed through smishing, malvertising, deceptive download sites, third-party forums, and trojanized APKs, it abuses Android Accessibility services to enable Wireless Debugging, pair with the device-local ADB daemon, and obtain shell-level execution. RatHat deploys external Go-based daemons and an FRP reverse-proxy client, creating persistence that can survive APK removal and maintaining remote access through NAT and firewall restrictions. The malware targets banking credentials and authentication data through fraudulent payment overlays, Accessibility-driven text capture, SMS and notification interception for OTP theft, screen capture, and raw `/dev/input` touch-event collection that can reconstruct PINs and unlock patterns. It also supports AI-assisted UI automation and uses HTTP, WebSocket, and persistent FRP tunnels for command-and-control. Defenses against analysis include malformed APK and manifest structures, DEX poisoning, encrypted strings, and checks for debuggers, Frida, Xposed, rooted devices, and emulators.
Sep 22, 2026
The **RedHook** Android banking trojan has resurfaced with upgraded remote-access capabilities that abuse Android **Wireless Debugging** and **Accessibility** features to gain shell-level privileges without rooting the device or exploiting a kernel flaw. Group-IB reported that the malware is being spread through social-engineering lures in which attackers impersonate government officials or bank support staff and direct victims to fake Google Play-style, government, or financial websites hosting malicious APKs, including on services such as **AWS S3** and **GitHub**. Recent activity shows the campaign expanding beyond Vietnam into **Indonesia**. After installation, RedHook tricks victims into enabling Accessibility Service, then automates **Developer Options** and Wireless Debugging, pairs itself over the loopback interface, and launches a privileged helper process running as `uid 2000`, reportedly using code derived from the **Shizuku** framework. In this mode, the malware can silently install apps, change secure settings, capture touch input, steal data, and stream screens or video, including screen capture that bypasses the normal **MediaProjection** consent prompt. Researchers said RedHook maintains persistence through watchdog services, cross-process resurrection, periodic alarms, reboot persistence, wake locks, silent audio playback, and a one-pixel activity, while its WebSocket-based command-and-control infrastructure supports **53 commands**.
Jul 15, 2026
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026