RatHat SystemHelperService Accessibility Abuse Enables Wireless Debugging

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•6

Detects unauthorized usage of the Android Accessibility Service to navigate system settings, specifically targeting the toggling of developer options and the extraction of 6-digit ADB pairing codes, as observed in the RatHat Android malware.