Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated Android banking trojan named RedHook has been discovered targeting Vietnamese users through spoofed government and financial websites. The malware uses WebSocket to communicate with its command-and-control server and supports over 30 remote commands, enabling complete control over compromised devices. RedHook combines phishing, RAT, and keylogging capabilities to exfiltrate credentials and conduct fraud. It abuses Android's MediaProjection API for screen capture and sends data to a live C2 server. The malware's low antivirus detection rate makes it a stealthy and active threat. Code artifacts suggest development by a Chinese-speaking threat actor or group. An exposed AWS S3 bucket revealed operational data dating back to November 2024, indicating a shift from previous scam campaigns to this advanced banking trojan.

RedHook is a sophisticated Android banking Trojan specifically targeting users in Vietnam by leveraging spoofed government and financial websites to lure victims. The malware establishes communication with its command-and-control (C2) infrastructure using WebSocket protocol, which allows for persistent, real-time bi-directional communication. RedHook supports over 30 remote commands, granting attackers extensive control over infected devices. Its capabilities include phishing to deceive users into divulging sensitive information, Remote Access Trojan (RAT) functionalities to control devices remotely, and keylogging to capture user input such as credentials. Notably, RedHook abuses Android's MediaProjection API to capture screen content stealthily, sending this data live to the C2 server, which enhances its ability to harvest sensitive information beyond just keystrokes. The malware maintains a low detection rate by antivirus solutions, increasing its stealth and persistence. Code analysis indicates the threat actor or group behind RedHook is likely Chinese-speaking, and operational data exposed via an unsecured AWS S3 bucket reveals that the campaign has been active since at least November 2024. This marks a strategic shift from previous scam campaigns to a more advanced and targeted banking Trojan. Indicators of compromise include multiple file hashes and suspicious domains associated with the malware's infrastructure.

Detailed information about RedHook: A New Android Banking Trojan Targeting Users In Vietnam. Get real-time updates, technical details, and mitigation strategies

Title	Severity	Type	Source	Date

Threats Tagged 'aws s3'

Filter Threats

Threats Tagged 'aws s3'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility