RatHat AdbTouchCapture Hardware Keylogger via getevent on Shell UID

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects the use of the 'getevent' utility by processes running under the 'shell' user (UID 2000) or accessing '/dev/input' directories, which is indicative of keylogging behavior often utilized by the RatHat Android malware to capture user input.