Christopher Morrison attacked the youngster at the Asda store in Clydebank, West Dunbartonshire, in September.
A judge heard the child told his mother what had happened moments after his ordeal, and Morrison was eventually arrested after his DNA linked him to the crime.
The 20-year-old pled guilty to the sex attack when he appeared at the High Court in Glasgow.
Morrison was remanded in custody and faces a lengthy jail-term when he is sentenced in the new year. He was also placed on the sex offenders register.
Prosecutor Bruce Erroch told how the boy had been out with his mother and grandmother on September 18.
The child needed to visit the toilet and went in alone. The court heard Morrison was already there and approached the boy.
Mr Erroch said: "He did not say anything, but he (Morrison) put his finger to his mouth as if to be quiet."
The boy was indecently assaulted before Morrison was seen leaving the scene.
The child then told his mother what had happened, claiming "a man" had done something to him.
Officers scoured CCTV footage and eventually traced Morrison, of Elderslie, Renfrewshire.
His DNA was found on the boy, but when quizzed about the attack, Morrison made no admissions.