Hagaseca is an Android malware cluster that targets devices with exposed Android Debug Bridge (ADB) services, particularly focusing on the THost9 RAT loader variant. It uses a packed APK to load a secondary stage (tc9.dex) that provides remote shell access, file transfer, and propagation capabilities. The malware abuses accessibility features for device control and establishes persistence via foreground services. It spreads opportunistically by scanning networks for exposed ADB endpoints, especially affecting Redroid container deployments and devices with public ADB over Wi-Fi. The malware exhibits worm-like behavior by authenticating with prepared keys and installing itself on vulnerable systems.