A new Android malware strain known as RedHook is quietly taking over infected phones by abusing a legitimate debugging feature, according to cybersecurity researchers at Group-IB. The remote access trojan exploits Android's Wireless Debugging capability to gain shell-level privileges, giving attackers extensive control over a compromised device without requiring full root access.
The attack begins with a social engineering campaign. Victims receive phone calls or messages from individuals posing as bank employees, government representatives, or technical support agents. The callers claim there is an urgent problem with the victim's bank account or a government service that requires immediate verification. Shortly after the call, a link arrives directing the victim to a website that closely resembles the Google Play Store or an official service page. The site prompts the user to download and install an app to resolve the supposed issue.
Because the app is not distributed through Google Play, victims must sideload it by installing an APK file from an external source. After installation, the app requests permission to use Android's Accessibility services, a feature designed to help users with disabilities navigate their devices. Once granted, this permission allows the malware to observe the screen, simulate taps, and navigate the phone's settings automatically.
RedHook then uses that control to enable Developer Options and activate Wireless Debugging, a feature introduced in Android 11 that allows developers to connect to a phone over Wi-Fi using the Android Debug Bridge (ADB). The malware requests a pairing code from the operating system, reads it, and connects back to the phone through the local address 127.0.0.1. This effectively tricks the device into granting itself deeper system access without requiring a physical USB connection or a computer.
Once paired, RedHook gains shell-level access, which gives it more authority than a standard Android application. It can run powerful system commands, modify protected settings, and capture low-level touch activity. The malware can also grant itself additional permissions and bypass certain confirmation screens that would normally alert the user to suspicious activity.
Group-IB researchers identified 53 distinct commands that attackers can send to the current version of RedHook. While some commands appear incomplete, the working features provide extensive capabilities. Attackers can watch victims log into banking applications, capture one-time verification codes, and overlay fake login screens on top of legitimate apps. The malware can also remove security software or install additional malicious applications without the user's knowledge.
RedHook incorporates several techniques to ensure it remains active on infected devices. It plays silent audio to make the operating system treat its process as important, uses a WakeLock to keep the CPU awake, and deploys two separate services that monitor each other and restart their partner if one stops. A five-minute alarm checks whether the malware's services are still running, and a receiver can restart the malware after a device reboot. The malware also adjusts its out-of-memory score to reduce the likelihood that Android will close it when system resources run low.
The malware borrows components from Shizuku, a legitimate Android utility used by developers and power users to access elevated features without rooting a device. RedHook repurposes parts of that framework to execute malicious commands.
Cybersecurity experts advise users to be cautious of unsolicited calls or messages that create a sense of urgency and request app installations. Legitimate organizations typically allow time for verification through official channels. Users should avoid installing APK files received through text messages, messaging apps, or unexpected phone calls. Enabling Google Play Protect and keeping the operating system updated can also help mitigate risks. If a suspicious app has already been installed, users should revoke its Accessibility permissions immediately and run a security scan.
