RatHat ADB Self-Pairing via Accessibility Service Abuse

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects unauthorized usage of Android Debug Bridge (ADB) commands for self-pairing or remote connection, along with behavioral indicators linked to the RatHat Go agent, including manual power management exemption settings, silent package installation with permission granting, and persistence via accessibility service enablement.