This paper is addressed with the attitude stabilization problem for spacecraft systems with external disturbances in physical layer and sensor and actuator attacks (SAAs) in cyber layer. Some state-dependent attacks are implanted in system measurement data channels and control input commands. Two stable adaptive backstepping controllers are constructed for two different assumption conditions with sensor attack, in which a compensation term in each controller is included to eliminate the effects of SAAs and recover the ideal system performance. Under the proposed control schemes, the system states can asymptotically converge to zero even if SAAs and external disturbances are co-existing.The validity of the developed scheme is demonstrated via a simulation example.