RatHat AdbTouchCapture getevent input keylogging via shell UID

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•4

Detects the execution of the 'getevent' utility by a process running with the 'shell' user ID, specifically targeting Android input device nodes. This pattern is indicative of the RatHat malware's AdbTouchCapture module, which is used to monitor touch events to facilitate the unauthorized capture of PINs or pattern locks.