Vendors have been shipping Android products with Android Debug Bridge enabled, making them attractive targets for hackers.

Researchers discovered a cryptocurrency mining botnet that uses the Android Debug Bridge (ADB) Wi-Fi interface and SSH connections to hosts stored in the known_hosts list to spread to other devices.

New Matryosh botnet is targeting Android systems that have left their ADB debug interface exposed on the internet.