RedHook is an Android RAT that autonomously abuses ADB Wireless Debugging features to escalate privileges and gain shell-level access. It integrates the Shizuku framework to execute protected system APIs, enhancing its control capabilities. The malware uses sophisticated persistence mechanisms including foreground activity spoofing, silent media playback, and cross-process monitoring to maintain presence on infected devices. It is distributed through social engineering tactics involving phone calls and messaging apps, convincing victims to download malicious APKs and enable Accessibility services under false pretenses. Recent campaigns have expanded from Vietnam to Indonesia, targeting Southeast Asian users via spoofed government and financial websites hosted on trusted platforms such as AWS S3 and GitHub. The malware supports 53 distinct server-issued commands, indicating a broad range of remote control functions.

The malware can gain shell-level access on Android devices by exploiting ADB Wireless Debugging and abusing protected system APIs via the Shizuku framework. This allows attackers to execute a wide range of commands remotely, potentially compromising device confidentiality, integrity, and availability. Its advanced persistence mechanisms make removal difficult, and social engineering distribution increases infection risk. The targeting of Southeast Asian users through trusted platforms and spoofed websites increases the likelihood of successful infections in that region.

No official patch or fix is available for this malware. Mitigation relies on user awareness to avoid social engineering traps such as unsolicited phone calls or messages prompting APK downloads or enabling Accessibility services. Users should disable ADB Wireless Debugging unless explicitly needed and avoid installing APKs from untrusted sources, even if hosted on reputable platforms. Monitoring and restricting Accessibility service permissions can reduce attack surface. Organizations should educate users in affected regions about this threat and encourage cautious behavior regarding app installations and permissions.