RedHook Android malware now uses Wireless ADB for shell access
The RedHook Android malware has evolved to abuse the Android Wireless Debugging (Wireless ADB) feature to gain shell-level privileges without requiring a computer connection or device rooting. It tricks users into granting Accessibility permissions to enable Developer Options and Wireless Debugging, then uses the pairing code to connect to the local ADB service. This grants it UID 2000 shell privileges, allowing it to execute privileged commands, install or uninstall apps silently, capture screen content, simulate user input, and more. The malware employs multiple persistence mechanisms to maintain its presence and is distributed via social engineering campaigns impersonating government or financial institutions. Android users are advised to install apps only from Google Play and scrutinize permissions carefully.
AI Analysis
Technical Summary
RedHook Android malware abuses the Wireless ADB feature introduced in Android 11 to gain shell-level privileges (UID 2000) without requiring root or a computer connection. It achieves this by tricking victims into granting Accessibility permissions, enabling Developer Options and Wireless Debugging, and retrieving the pairing code displayed on the device. The malware then connects to the local ADB service via loopback (127.0.0.1) and uses a Shizuku-based framework to execute privileged shell commands. These commands allow it to perform a wide range of malicious activities including screen streaming, input simulation, app management, data theft, device locking/unlocking, camera activation, and rebooting. Persistence is maintained through silent audio playback, WakeLocks, mutual service restarts, watchdog alarms, and other techniques. Distribution relies on social engineering via fake Google Play sites.
Potential Impact
The malware gains elevated shell privileges (UID 2000), which are more powerful than normal app permissions but not full root. This allows it to silently install or remove apps, modify protected settings, steal credentials and sensitive data, capture screen content, simulate user interactions, and control device functions such as locking, unlocking, camera activation, and rebooting. Its persistence mechanisms make removal difficult. The attack does not require rooting the device, increasing its potential reach across Android devices supporting Wireless ADB.
Mitigation Recommendations
No official patch is indicated. Since the attack requires the user to grant Accessibility Service permissions and enable Wireless Debugging, users should avoid granting Accessibility permissions to untrusted apps and scrutinize permission requests carefully. Installing apps only from Google Play and ensuring Google Play Protect is active can reduce risk. Users should be cautious of social engineering attempts impersonating trusted entities. There is no indication that the malware exploits a vulnerability that can be patched; mitigation focuses on user awareness and permission hygiene.
RedHook Android malware now uses Wireless ADB for shell access
Description
The RedHook Android malware has evolved to abuse the Android Wireless Debugging (Wireless ADB) feature to gain shell-level privileges without requiring a computer connection or device rooting. It tricks users into granting Accessibility permissions to enable Developer Options and Wireless Debugging, then uses the pairing code to connect to the local ADB service. This grants it UID 2000 shell privileges, allowing it to execute privileged commands, install or uninstall apps silently, capture screen content, simulate user input, and more. The malware employs multiple persistence mechanisms to maintain its presence and is distributed via social engineering campaigns impersonating government or financial institutions. Android users are advised to install apps only from Google Play and scrutinize permissions carefully.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RedHook Android malware abuses the Wireless ADB feature introduced in Android 11 to gain shell-level privileges (UID 2000) without requiring root or a computer connection. It achieves this by tricking victims into granting Accessibility permissions, enabling Developer Options and Wireless Debugging, and retrieving the pairing code displayed on the device. The malware then connects to the local ADB service via loopback (127.0.0.1) and uses a Shizuku-based framework to execute privileged shell commands. These commands allow it to perform a wide range of malicious activities including screen streaming, input simulation, app management, data theft, device locking/unlocking, camera activation, and rebooting. Persistence is maintained through silent audio playback, WakeLocks, mutual service restarts, watchdog alarms, and other techniques. Distribution relies on social engineering via fake Google Play sites.
Potential Impact
The malware gains elevated shell privileges (UID 2000), which are more powerful than normal app permissions but not full root. This allows it to silently install or remove apps, modify protected settings, steal credentials and sensitive data, capture screen content, simulate user interactions, and control device functions such as locking, unlocking, camera activation, and rebooting. Its persistence mechanisms make removal difficult. The attack does not require rooting the device, increasing its potential reach across Android devices supporting Wireless ADB.
Mitigation Recommendations
No official patch is indicated. Since the attack requires the user to grant Accessibility Service permissions and enable Wireless Debugging, users should avoid granting Accessibility permissions to untrusted apps and scrutinize permission requests carefully. Installing apps only from Google Play and ensuring Google Play Protect is active can reduce risk. Users should be cautious of social engineering attempts impersonating trusted entities. There is no indication that the malware exploits a vulnerability that can be patched; mitigation focuses on user awareness and permission hygiene.
Threat ID: 6a53ac8d68715ace436b4fed
Added to database: 07/12/2026, 15:02:37 UTC
Last enriched: 07/12/2026, 15:02:47 UTC
Last updated: 07/12/2026, 16:10:53 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.