RatHat Go Agent Silent APK Reinstall via pm install After Uninstall

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects suspicious Android application installation attempts using the 'pm install' command, triggered by processes or libraries named 'local-service' or 'liblocal-service.so'. This behavior is often associated with the manual side-loading of potentially malicious APK files in an Android environment.