You can run any ADB command on your phone without ever connecting it to a PC.
Over 100 Chrome extensions sharing C&C infrastructure were seen stealing user data, injecting ads, and containing a backdoor.