Loading story…
The RedHook Android banking trojan has resurfaced with upgraded remote-access capabilities that abuse Android Wireless Debugging and Accessibility features to gain shell-level privileges without rooting the device or exploiting a kernel flaw. Group-IB reported that the malware is being spread through social-engineering lures in which attackers impersonate government officials or bank support staff and direct victims to fake Google Play-style, government, or financial websites hosting malicious APKs, including on services such as AWS S3 and GitHub. Recent activity shows the campaign expanding beyond Vietnam into Indonesia.
After installation, RedHook tricks victims into enabling Accessibility Service, then automates Developer Options and Wireless Debugging, pairs itself over the loopback interface, and launches a privileged helper process running as uid 2000, reportedly using code derived from the Shizuku framework. In this mode, the malware can silently install apps, change secure settings, capture touch input, steal data, and stream screens or video, including screen capture that bypasses the normal MediaProjection consent prompt. Researchers said RedHook maintains persistence through watchdog services, cross-process resurrection, periodic alarms, reboot persistence, wake locks, silent audio playback, and a one-pixel activity, while its WebSocket-based command-and-control infrastructure supports 53 commands.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Group-IB published analysis that RedHook had re-emerged with new capabilities, including abuse of Android Wireless Debugging and Accessibility features to gain shell-level privileges without rooting devices. The report also described expanded targeting beyond Vietnam into Indonesia, social-engineering delivery via fake government and financial sites, and WebSocket-based command-and-control.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcegroup-ib.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **RatHat**, an Android banking trojan and remote-access tool tentatively linked to China-based operators. Distributed through smishing, malvertising, deceptive download sites, third-party forums, and trojanized APKs, it abuses Android Accessibility services to enable Wireless Debugging, pair with the device-local ADB daemon, and obtain shell-level execution. RatHat deploys external Go-based daemons and an FRP reverse-proxy client, creating persistence that can survive APK removal and maintaining remote access through NAT and firewall restrictions. The malware targets banking credentials and authentication data through fraudulent payment overlays, Accessibility-driven text capture, SMS and notification interception for OTP theft, screen capture, and raw `/dev/input` touch-event collection that can reconstruct PINs and unlock patterns. It also supports AI-assisted UI automation and uses HTTP, WebSocket, and persistent FRP tunnels for command-and-control. Defenses against analysis include malformed APK and manifest structures, DEX poisoning, encrypted strings, and checks for debuggers, Frida, Xposed, rooted devices, and emulators.
Sep 16, 2026
Researchers reported **RedWing**, a newly identified Android spyware and malware-as-a-service operation marketed through Telegram and distributed via sideloaded apps and mobile phishing pages. The service packages custom droppers, fake app-store lures, phishing templates, operator guides, and subscription tiers that lower the barrier for bank-fraud actors. Investigators said the campaign heavily targets financial institutions—especially Russian banks and crypto services—and currently includes targeting for **82 institutions** across multiple sectors, with infrastructure and tradecraft suggesting a strong Russian-market orientation. Once installed and granted permissions, RedWing gives operators extensive control over infected devices by abusing Android **Accessibility Services**, overlay permissions, default SMS handler privileges, and **MediaProjection**. The malware can harvest credentials and one-time codes, intercept SMS, enable call forwarding, stream the screen, log keystrokes, capture audio and camera feeds, and access files, contacts, call logs, and location, allowing it to bypass SMS- and voice-based 2FA. Researchers also found similarities to the **Oblivion** malware family and said RedWing can dynamically update targeted apps and phishing overlays from its command-and-control panel without requiring a new malware build.
Aug 11, 2026
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026