- Red Hook malware now uses Android’s Wireless Debugging to get shell-level access to a phone without needing to plug in a USB cable or root access.
- The malware basically gets to control every aspect of your phone, stealing data, spying on your screen in real time, and even turning on your camera without you lifting a finger.
- The attack starts with a social engineering trick that lures the victim into installing fake as well as granting accessibility permissions.
The RedHook threat has evolved again. The new variant can exploit a native Android feature to get full control over the device without root or any connection to a PC.
According to Group-IB security analysts, the new malware variant uses the Wireless Android Debug Bridge (Wireless ADB) to get shell-level privileges.
They do it by tricking the victim into activating some legitimate Android functionalities. This is a huge step ahead for the RedHook variant that was revealed for the first time in 2025.
Turning Android’s Tools Against Users
ADB stands for Android Debug Bridge. It’s a legit debugging tool that developers can use to work with their Android devices from a computer. ADB lets them run commands, install new apps, and troubleshoot their Android phone from their desktop computer.
No need to connect a USB cable to make that happen. Group-IB says RedHook, a new piece of malware, twists this feature in a way most people haven’t seen. Instead of waiting for someone’s computer to hook up, RedHook turns the infected phone into an ADB client all by itself.
The first step in the attack involves enticing the victim to download and install a malicious application onto their phone. Attackers try to get to the people by tricking them with fraudulent messages or calls posing as a bank or government department, etc.
Once the malicious app is installed, it asks for Accessibility Service permissions – the type that’s designed to help people with disabilities manage their phone a bit easier. But of course, malware has been taking advantage of them for ages because they let an app watch the screen and automate things.
After receiving Accessibility access, RedHook navigates through the Settings app on its own. It enables Developer Options and activates Wireless Debugging. Then it reads the pairing code, which pops up on the screen, and afterwards, establishes an ADB connection via loopback IP address (127.0.0.1).
This gives it shell privileges. That is not full root access, but significantly more authority than a normal Android application.
Shizuku Expands Its Capabilities
Researchers also found that RedHook leverages Shizuku, a legitimate utility for Android enthusiasts and developers. Shizuku allows applications to access privileged Android APIs through shell permissions without requiring root access.
RedHook uses a Shizuku-based framework, including a component identified as libmx.so, to execute shell commands. This allows it to perform operations that would normally require additional user approval.
With these privileges, the malware can silently install or uninstall applications. It can change protected Android settings and grant itself extra permissions. It can also interact with system components in ways unavailable to ordinary apps.
This abuse of legitimate tools makes the malware more flexible while reducing the need to exploit security flaws.
A Full-Featured Remote Access Trojan
Beyond its new privilege escalation method, RedHook remains a powerful remote access trojan. Group-IB says the latest version supports 53 commands issued by its command-and-control server.
These capabilities give hackers the power to live-stream the victim’s screen in real time and take snapshots at will. The scale of malware distribution is evident in other campaigns; hackers hijacked 250 websites, including Harvard’s blog, to spread malware.
Malware can tap into keyboard input, mimic finger taps, screen swipes, & long presses, not to mention forcing a device to lock or unlock at whim, downloading & removing apps on the fly, and snatching contact lists & SMS messages.
Also, the malware can display fake overlays on the infected device’s screen and also initiate verification prompts. It can turn on the phone camera and reboot the phone remotely as well.
These functions, altogether, enable an attacker to monitor their victims, steal information, and commit financial fraud. They can practically control the device with little to no input from the user.
RedHook is Stealthy & Persistent
The latest RedHook release includes several mechanisms to remain active even when users attempt to stop it. Researchers observed that the malware uses silent audio playback to increase its execution priority.
It uses WakeLocks to prevent the processor from sleeping. Also, there are background processes that pair with each other and automatically restart in case any of them stops running.
To remain persistent, this malware comes with a watchdog timer that it uses to check every five minutes if the malware is still running. The malware can start automatically each time the user turns on their device.
Also, it quietly modifies the Android oom_score_adj. That way, it weakens the system’s ability to terminate the process when memory space becomes low.
These techniques make RedHook considerably harder to remove during normal device operation.
A Growing Trend in Android Attacks
The latest RedHook campaign reflects a broader shift in Android malware development. It’s becoming increasingly easy for bad actors to abuse legit helpful Android features that users enable without knowing it.
Features like Accessibility Services, Dev Options, Wireless Debugging, and some solid tools like Shizuku are helpful when used on your own. But when attackers pair them with social engineering attacks, they can turn into powerful tools to control a device.
To defenders, keeping users safe from this malware infection all comes down to creating awareness among users. Also, Google needs to put high level security controls in place.
Security pros advise only getting apps from the Google Play Store. Also, keep a close eye on what permissions your apps request, plus turn on Google Play Protect. Don’t be too trusting of calls saying you need to upgrade your software or download something right away.
Finally, bear in mind that these threats aren’t going to stop anytime soon; if anything, they’re increasing. Attackers are getting smarter at exploiting features we trust rather than breaking them. So everyone should stay aware, careful, and alert.
