A new Mirai-derived botnet, identified as xlabs_v1, has emerged targeting internet-exposed Android devices via the Android Debug Bridge (ADB). According to Hunt.io, the botnet leverages ADB's lack of default authentication on many IoT devices to install a persistent DDoS agent. This represents a significant shift in botnet evolution, moving from traditional Linux servers to the vast, often unmanaged ecosystem of Android-based IoT hardware. The botnet's ability to self-propagate through ADB scanning suggests a high degree of automation. Researchers noted that the C2 infrastructure is currently hosted in the Netherlands, though the botnet's targets are global. This development underscores the persistent risk of 'developer' features like ADB being left enabled in production environments, providing a trivial entry point for automated exploit chains.