RedHook Android Malware Exploits Wireless ADB to Gain Advanced Device Control

Quick Summary

Cybersecurity researchers have identified a significantly more capable version of the RedHook Android malware that abuses Wireless Android Debug Bridge (ADB) to gain shell-level privileges without requiring a USB connection. The malware expands remote control capabilities, posing a greater threat to banking credentials, personal data, and Android device security.

A New Evolution of RedHook Malware

A newly discovered version of the RedHook Android malware is introducing a sophisticated attack technique by exploiting Wireless Android Debug Bridge (Wireless ADB), allowing attackers to gain elevated shell-level privileges without physically connecting a computer to the infected device.

Researchers at Group-IB say the latest variant represents a major upgrade over the version first documented in 2025. While RedHook continues to function as a powerful remote access trojan (RAT), it now combines Android’s developer features with legitimate system tools to significantly expand what attackers can do once a device is compromised.

Unlike traditional ADB attacks that require a USB cable or another trusted device, this version performs the entire pairing process directly on the victim’s phone.

How the Attack Works

The infection typically begins through social engineering.

Victims receive phone calls or text messages from attackers pretending to represent banks, government agencies, utility providers, or customer support teams. They are directed to counterfeit websites designed to resemble Google Play or trusted organizations, where they are persuaded to install a malicious application.

The malware then requests Accessibility Service permissions. Once granted, it can automatically navigate Android settings, enable Developer Options, activate Wireless Debugging, retrieve the displayed pairing code, and establish a connection with the device’s own ADB service using the local loopback interface.

This process grants the malware shell-level (UID 2000) privileges, providing far greater access than a standard Android application while stopping short of full root access.

Shizuku Enables Additional Privileged Operations

RedHook also leverages Shizuku, a legitimate Android utility commonly used by developers and advanced users to access privileged Android APIs without rooting a device.

By executing Shizuku as part of its attack chain, the malware can silently perform operations normally unavailable to ordinary applications, including:

• Install or uninstall applications silently
• Modify protected Android settings
• Execute shell commands
• Grant itself additional permissions
• Perform privileged system operations without displaying user prompts

Researchers emphasize that the malware abuses Shizuku rather than exploiting a vulnerability in the tool itself.

Expanded Remote Access Capabilities

According to Group-IB, the latest RedHook release now supports 53 remote commands, a significant increase from the 34 commands identified in earlier versions.

The malware can:

• Stream the device’s screen in real time
• Capture screenshots
• Record keystrokes
• Simulate taps, swipes, long presses, and gestures
• Collect SMS messages, contacts, and installed applications
• Lock or unlock the device
• Activate the camera
• Install, launch, or remove applications
• Display fake verification or banking dialogs
• Reboot the device remotely

Researchers also identified several persistence techniques designed to keep the malware running, including watchdog timers, automatic restart after reboot, WakeLocks to prevent CPU sleep, silent audio playback to maintain process priority, and mutually restarting background services.

Banking Users Face Elevated Risk

Because many users perform banking, identity verification, and two-factor authentication from the same smartphone, RedHook creates an opportunity for attackers to capture login credentials alongside one-time verification codes.

Researchers have confirmed campaigns targeting users in Vietnam and Indonesia, although they warn that the same tactics can easily be adapted for other countries by changing branding, language, and the organizations being impersonated.

Protecting Android Devices

Security experts recommend installing applications only from the official Google Play Store, avoiding downloads from links received through calls or messages, carefully reviewing permission requests—particularly Accessibility permissions—and ensuring Google Play Protect remains enabled.

Users should also verify unexpected requests from banks or government agencies through official websites or customer support channels before installing any application.

Sources

• Group-IB
• BleepingComputer