THost9 Android RAT Exploits ADB Services to Spread Malware

• •THost9 RAT uses a concealed loader to exploit exposed ADB services.
• •The malware can install itself on a wide range of devices through an ADB worm.
• •Public incident reports link THost9 to infections dating back to October 2024.

The THost9 Android remote access trojan (RAT), part of the Hagaseca malware cluster, has been identified as a significant threat. It employs a concealed loader that hides executable code within an Android application package, which then loads a second-stage payload called tc9.dex. This malware targets exposed Android Debug Bridge (ADB) services to install itself on vulnerable devices. The ADB worm can discover services and authenticate using prepared key material, allowing it to install the malware across a wide range of devices. Public incident reports link THost9 and its predecessor THost4 to infections on Android phones and Redroid containers. Dark Atlas researchers confirmed the malware's command-and-control host was still accepting connections as of September 4, 2026. The malware's propagation capabilities raise concerns about widespread infections, particularly among users with exposed ADB services. Security experts recommend removing public ADB exposure and reviewing accessibility settings to mitigate risks.