RedHook Android RAT Gains Shell-Level Access via Wireless Debugging Abuse

The RedHook Android banking trojan has resurfaced with upgraded remote-access capabilities that abuse Android Wireless Debugging and Accessibility features to gain shell-level privileges without rooting the device or exploiting a kernel flaw. Group-IB reported that the malware is being spread through social-engineering lures in which attackers impersonate government officials or bank support staff and direct victims to fake Google Play-style, government, or financial websites hosting malicious APKs, including on services such as AWS S3 and GitHub. Recent activity shows the campaign expanding beyond Vietnam into Indonesia.

After installation, RedHook tricks victims into enabling Accessibility Service, then automates Developer Options and Wireless Debugging, pairs itself over the loopback interface, and launches a privileged helper process running as uid 2000, reportedly using code derived from the Shizuku framework. In this mode, the malware can silently install apps, change secure settings, capture touch input, steal data, and stream screens or video, including screen capture that bypasses the normal MediaProjection consent prompt. Researchers said RedHook maintains persistence through watchdog services, cross-process resurrection, periodic alarms, reboot persistence, wake locks, silent audio playback, and a one-pixel activity, while its WebSocket-based command-and-control infrastructure supports 53 commands.