RedHook Android Malware Exploits Wireless ADB for Deep Device Access
A new version of the RedHook Android malware exploits the Wireless Debugging feature to gain shell-level privileges without needing a physical computer connection. Researchers at Group-IB discover that the malware tricks victims into granting Accessibility permissions, which it then uses to automatically enable Developer Options and activate Wireless Debugging on the device.
Once Wireless Debugging is active, RedHook retrieves the pairing code from the screen and connects to the phone's ADB service through the loopback interface. This grants the malware shell privileges that are far more powerful than those of normal Android apps. The attack works on any non-rooted device, making it a broad threat across the Android ecosystem.
After gaining shell access, RedHook deploys a Shizuku-based framework to execute privileged commands, modify protected settings, silently install or remove apps, and perform other actions without alerting the user. The malware also retains its remote access trojan features, allowing attackers to stream the screen, intercept keystrokes, automate UI interactions, and steal credentials from compromised devices.