Loading malware…
RedHook is an Android banking trojan with extensive remote-access capabilities, first documented in July 2025. It targets users in Southeast Asia, including Vietnam and Indonesia. Operators impersonate government agencies, financial institutions, and support personnel through phone calls and messaging applications such as Zalo. Victims are directed to counterfeit government, financial, or Google Play pages and persuaded to install malicious APKs and grant Accessibility access. Payloads have also been hosted on legitimate services, including GitHub and Amazon S3.
RedHook abuses Accessibility to automate enabling Developer Options and Wireless Debugging, retrieve the displayed pairing code, and pair its embedded ADB client with the infected device’s local ADB service. This provides Android shell privileges under UID 2000, not root access, without requiring an external computer. A privileged helper incorporating Shizuku-derived functionality enables protected API access, arbitrary shell commands, runtime permission grants, secure-settings changes, silent application installation and removal, and low-level touch capture.
Its surveillance and theft capabilities include keylogging, credential and screen-lock credential theft, screenshots, screen streaming, camera activation, and collection of SMS messages, contacts, and installed-application information. Operators can automate gestures, display overlays and fake verification dialogs, manage applications, and control device state through 53 supported server commands. Command-and-control and screen streaming use WebSockets, with REST APIs handling larger data transfers and privileged RTMP streaming bypassing normal MediaProjection consent.
RedHook maintains persistence through a nearly invisible activity, silent audio playback, WakeLocks, mutually restarting services, periodic watchdog alarms, and boot-triggered restoration of its services and ADB access. These mechanisms help preserve execution and resist process termination.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
RedHook flips this developer feature into an attack tool by running automated taps through the Accessibility service, turning on Developer Options, enabling Wireless Debugging, and pairing itself as though it were an authorized computer.
The latest version of RedHook is distributed through social engineering, via messages and phone calls where attackers impersonate government agencies or financial institutions to direct victims to fake Google Play sites.
Other mechanisms include a five-minute watchdog alarm, automatic restart after device boot, and setting oom_score_adj to -1000 to reduce the likelihood of being killed when available system memory is low.
Next, the malware deploys a Shizuku-based framework to execute shell commands, grant itself additional permissions, modify protected Android settings, silently install or remove applications, and perform various operations without displaying user dialogs.
The malicious app is spread through social engineering, with attackers posing as government officials or bank support staff over phone calls and messaging apps like Zalo.
Victims are guided to fake websites styled to resemble the Google Play Store, where they are tricked into downloading a malicious APK.
RedHook implements a two-service cross-process resurrection mechanism for persistence. Each service runs in a separate process and binds to the other via bindService() with BIND_AUTO_CREATE flag... creating a loop that requires both processes to be terminated simultaneously to break.
Other mechanisms include a five-minute watchdog alarm, automatic restart after device boot, and setting oom_score_adj to -1000 to reduce the likelihood of being killed when available system memory is low.
RedHook flips this developer feature into an attack tool by running automated taps through the Accessibility service, turning on Developer Options, enabling Wireless Debugging, and pairing itself as though it were an authorized computer.
It also grants WRITE_SECURE_SETTINGS. With that, it is able to modify entries in Settings.Secure.
The entire attack chain does not require the device to be rooted, so it works across all Android devices as long as the user is tricked into approving the Accessibility Service permission request.
Other mechanisms include a five-minute watchdog alarm, automatic restart after device boot, and setting oom_score_adj to -1000 to reduce the likelihood of being killed when available system memory is low.
Other mechanisms include a five-minute watchdog alarm, automatic restart after device boot, and setting oom_score_adj to -1000 to reduce the likelihood of being killed when available system memory is low.
After that, the malware retrieves the pairing code displayed on the screen and connects to the phone’s ADB service via the loopback interface (127.0.0.1). Once paired, the malware gains shell (UID 2000) privileges, which are significantly more powerful than those available to normal Android apps, though not root-level.
RedHook flips this developer feature into an attack tool by running automated taps through the Accessibility service, turning on Developer Options, enabling Wireless Debugging, and pairing itself as though it were an authorized computer.
The entire attack chain does not require the device to be rooted, so it works across all Android devices as long as the user is tricked into approving the Accessibility Service permission request.
Other mechanisms include a five-minute watchdog alarm, automatic restart after device boot, and setting oom_score_adj to -1000 to reduce the likelihood of being killed when available system memory is low.
RedHook essentially turns the phone into its own ADB client by tricking the victim into granting it Accessibility permissions, which let it automatically manipulate Settings, enable Developer Options, and activate Wireless Debugging.
The latest version of RedHook is distributed through social engineering, via messages and phone calls where attackers impersonate government agencies or financial institutions to direct victims to fake Google Play sites.
RedHook flips this developer feature into an attack tool by running automated taps through the Accessibility service, turning on Developer Options, enabling Wireless Debugging, and pairing itself as though it were an authorized computer.
RedHook executes Shizuku code as part of its attack chain, using it as a privileged server (libmx.so) to invoke privileged Android APIs as UID 2000.
RedHook flips this developer feature into an attack tool by running automated taps through the Accessibility service... all while a hidden overlay screen keeps the victim in the dark.
RedHook implements a two-service cross-process resurrection mechanism for persistence. Each service runs in a separate process and binds to the other via bindService() with BIND_AUTO_CREATE flag... creating a loop that requires both processes to be terminated simultaneously to break.
It also grants WRITE_SECURE_SETTINGS. With that, it is able to modify entries in Settings.Secure.
At the same time, the malware retains its remote access trojan (RAT) features, allowing it to stream the screen, intercept keystrokes, automate UI interactions, and steal credentials.
While retaining core RAT functionalities, such as screen streaming and keylogging... Capabilities are largely consistent with what we typically see in an Android RAT: ... keylogging
At the same time, the malware retains its remote access trojan (RAT) features, allowing it to stream the screen, intercept keystrokes, automate UI interactions, and steal credentials.
At the same time, the malware retains its remote access trojan (RAT) features, allowing it to stream the screen, intercept keystrokes, automate UI interactions, and steal credentials.
While retaining core RAT functionalities, such as screen streaming and keylogging... Capabilities are largely consistent with what we typically see in an Android RAT: ... keylogging
the current version of the malware supports 53 server-issued commands, which include: Screen streaming and screenshot capturing
RedHook utilizes WebSocket protocols for its command-and-control (C2) infrastructure and screen streaming, whereas more substantial data payloads are sent to specific REST API endpoints.
while sending larger volumes of stolen data, such as passwords and messages, to dedicated web addresses.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.