During laboratory testing, Lookout researchers identified hard-coded shell commands (setprop service.adb.tcp.port 5555 followed by stop adbd && start adbd) that reopen ADB in TCP mode, a feature quietly advertised on Meiya Pico’s commercial site as a 2024 “Mobile Master Series” upgrade. For corporate security teams, the finding underscores the importance of “travel mode” policies that disable USB debugging, enforce strong device encryption, and perform post-trip integrity scans capable of detecting residual artifacts such as the stray mfsocket.xml or cached SQLite extracts that Massistant occasionally leaves behind. Unlike conventional spyware that relies on covert remote delivery, Massistant is installed physically when a device is in official custody, then pairs with a Meiya Pico “Mobile Master” workstation to conduct a high-speed forensic dump. Travellers report finding the unfamiliar icon only after their phones are returned, while forensic analysts have traced every variant to a signing certificate belonging to Xiamen Meiya Pico Information Co., Ltd.—a firm now re-branded as SDIC Intelligence yet still controlling roughly 40% of China’s digital-forensics market. Emerging in mid-2023 as an apparent successor to Meiya Pico’s notorious MFSocket, the newly identified Android application Massistant has begun surfacing on confiscated handsets at Chinese border checkpoints and police stations. The combination of USB installation, Accessibility bypass, and transient ADB-over-Wi-Fi sessions enables investigators to dump messages from Signal, Telegram and Letstalk—even when those apps encrypt local storage—before scrubbing the forensic implant. Massistant then opens a local service on TCP/10102 and waits for the desktop client to forward Android Debug Bridge (ADB) commands across the USB link, harvesting data partitions within minutes. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The native library libNativeUtil.so further exposes an ADB-over-Wi-Fi backdoor: once the forensic laptop authenticates over USB, it can switch to the device’s WLAN interface, copy auxiliary binaries and continue extraction untethered.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 17 Jul 2025 16:05:14 +0000