Malware

RedHook

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

RedHook flips this developer feature into an attack tool by running automated taps through the Accessibility service, turning on Developer Options, enabling Wireless Debugging, and pairing itself as though it were an authorized computer.

T1566PhishingEvidence1

Victims are guided to fake websites styled to resemble the Google Play Store, where they are tricked into downloading a malicious APK.

Execution

2 techniques

T1204User ExecutionEvidence1

The malicious app is spread through social engineering, with attackers posing as government officials or bank support staff over phone calls and messaging apps like Zalo.

T1204.002Malicious FileEvidence1

Victims are guided to fake websites styled to resemble the Google Play Store, where they are tricked into downloading a malicious APK.

Persistence

3 techniques

T1078Valid AccountsEvidence1

T1546.008Accessibility FeaturesEvidence1

Once installed, the app pushes users through a fake onboarding flow to enable Accessibility Service, framing it as a routine step needed to use the app properly.

T1547Boot or Logon Autostart ExecutionEvidence1

Two of its internal services also watch over each other, instantly relaunching a partner process if it gets killed, creating a loop that is difficult to fully stop.

Privilege Escalation

4 techniques

T1078Valid AccountsEvidence1

T1546.008Accessibility FeaturesEvidence1

Once installed, the app pushes users through a fake onboarding flow to enable Accessibility Service, framing it as a routine step needed to use the app properly.

T1547Boot or Logon Autostart ExecutionEvidence1

Two of its internal services also watch over each other, instantly relaunching a partner process if it gets killed, creating a loop that is difficult to fully stop.

T1548Abuse Elevation Control MechanismEvidence1

Rather than relying on complex exploits, the malware weaponizes ADB Wireless Debugging, a tool built for app developers, to grant itself privileges normally reserved for system-level processes.

Stealth

4 techniques

T1036MasqueradingEvidence1

Once paired, the malware launches its own privileged shell process known as uid 2000, essentially posing as a trusted system user that Android grants far more freedom than an ordinary app.

T1078Valid AccountsEvidence1

T1218System Binary Proxy ExecutionEvidence1

Once paired, the malware launches its own privileged shell process known as uid 2000.

T1564Hide ArtifactsEvidence1

RedHook flips this developer feature into an attack tool by running automated taps through the Accessibility service... all while a hidden overlay screen keeps the victim in the dark.

Credential Access

1 technique

T1056Input CaptureEvidence1

From that position, RedHook can install or remove apps, alter secure device settings, and capture raw touch input without ever needing user approval.

Collection

2 techniques

T1056Input CaptureEvidence1

From that position, RedHook can install or remove apps, alter secure device settings, and capture raw touch input without ever needing user approval.

T1113Screen CaptureEvidence1

For communication, the malware relies on WebSocket connections for screen streaming... With shell level privileges active, it can also stream video over RTMP, bypassing the usual consent screen Android shows when an app tries to record the display.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

For communication, the malware relies on WebSocket connections for screen streaming and command delivery.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

while sending larger volumes of stolen data, such as passwords and messages, to dedicated web addresses.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jul 9, 2026

RedHook Android RAT Abuses ADB Wireless Debugging to Gain Shell-Level Access

Android banking trojan/RAT that abuses Accessibility Service and ADB Wireless Debugging to gain elevated privileges, silently install or remove apps, alter secure settings, capture touch input, stream screens, and steal passwords and messages.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

RedHook

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

T1566PhishingEvidence1

Victims are guided to fake websites styled to resemble the Google Play Store, where they are tricked into downloading a malicious APK.

Execution

2 techniques

T1204User ExecutionEvidence1

The malicious app is spread through social engineering, with attackers posing as government officials or bank support staff over phone calls and messaging apps like Zalo.

T1204.002Malicious FileEvidence1

Victims are guided to fake websites styled to resemble the Google Play Store, where they are tricked into downloading a malicious APK.

Persistence

3 techniques

T1078Valid AccountsEvidence1

T1546.008Accessibility FeaturesEvidence1

Once installed, the app pushes users through a fake onboarding flow to enable Accessibility Service, framing it as a routine step needed to use the app properly.

T1547Boot or Logon Autostart ExecutionEvidence1

Two of its internal services also watch over each other, instantly relaunching a partner process if it gets killed, creating a loop that is difficult to fully stop.

Privilege Escalation

4 techniques

T1078Valid AccountsEvidence1

T1546.008Accessibility FeaturesEvidence1

Once installed, the app pushes users through a fake onboarding flow to enable Accessibility Service, framing it as a routine step needed to use the app properly.

T1547Boot or Logon Autostart ExecutionEvidence1

Two of its internal services also watch over each other, instantly relaunching a partner process if it gets killed, creating a loop that is difficult to fully stop.

T1548Abuse Elevation Control MechanismEvidence1

Rather than relying on complex exploits, the malware weaponizes ADB Wireless Debugging, a tool built for app developers, to grant itself privileges normally reserved for system-level processes.

Stealth

4 techniques

T1036MasqueradingEvidence1

Once paired, the malware launches its own privileged shell process known as uid 2000, essentially posing as a trusted system user that Android grants far more freedom than an ordinary app.

T1078Valid AccountsEvidence1

T1218System Binary Proxy ExecutionEvidence1

Once paired, the malware launches its own privileged shell process known as uid 2000.

T1564Hide ArtifactsEvidence1

RedHook flips this developer feature into an attack tool by running automated taps through the Accessibility service... all while a hidden overlay screen keeps the victim in the dark.

Credential Access

1 technique

T1056Input CaptureEvidence1

From that position, RedHook can install or remove apps, alter secure device settings, and capture raw touch input without ever needing user approval.

Collection

2 techniques

T1056Input CaptureEvidence1

From that position, RedHook can install or remove apps, alter secure device settings, and capture raw touch input without ever needing user approval.

T1113Screen CaptureEvidence1

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

For communication, the malware relies on WebSocket connections for screen streaming and command delivery.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

while sending larger volumes of stolen data, such as passwords and messages, to dedicated web addresses.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jul 9, 2026

RedHook Android RAT Abuses ADB Wireless Debugging to Gain Shell-Level Access

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.