A New Variant of RedHook Malware Exploits Wireless ADB to Gain Shell Access on Android Devices
Researchers at Group-IB have uncovered a novel way that the RedHook Android malware is gaining shell-level privileges on mobile devices. The latest version of this malicious software takes advantage of the Android Wireless Debugging (Wireless ADB) mechanism, allowing it to access sensitive functions without requiring a physical connection between the device and a computer.
This sophisticated attack vector is particularly concerning because it doesn’t require the device to be rooted or even connected to a computer. RedHook achieves its goal by tricking users into granting Accessibility permissions, which enables the malware to manipulate system settings and activate Wireless Debugging. The malware then connects to the phone’s ADB service via the loopback interface (127.0.0.1) and gains shell privileges as UID 2000.
Once paired, the malware deploys a Shizuku-based framework to execute commands, grant itself additional permissions, modify protected Android settings, install or remove applications, and perform various operations without displaying user dialogs. This advanced capability allows RedHook to access sensitive functions such as screen streaming, keystroke interception, and credential theft. The current version of the malware supports 53 server-issued commands.
One of the most notable aspects of this attack chain is its reliance on legitimate Android utilities like Shizuku. This framework is a popular tool among power users and developers, but when used maliciously by RedHook, it becomes a powerful exploit. Group-IB’s report highlights how RedHook executes Shizuku code as part of its attack chain, using it as a privileged server to invoke privileged Android APIs.
The distribution of the malware is largely facilitated through social engineering tactics, where attackers pose as government agencies or financial institutions and direct victims to fake Google Play sites. To mitigate this threat, users are advised to exercise caution when installing apps from unknown sources and ensure that Play Protect is active on their device. This includes scrutinizing requested permissions at installation time.
The RedHook malware’s evolution serves as a stark reminder of the importance of vigilance in mobile security. As attackers continually adapt and refine their tactics, it’s essential for users to stay informed about emerging threats and implement robust security measures to protect themselves against these sophisticated attacks. With the increasing reliance on mobile devices for personal and professional activities, staying one step ahead of malware like RedHook is crucial.
In practical terms, Android users should be cautious when granting permissions and carefully review app installation settings. Regularly updating Play Protect can also help prevent malicious apps from being installed on a device. By prioritizing security awareness and adopting best practices in mobile security, individuals can reduce their exposure to threats like the latest RedHook variant.
Source: Bleeping Computer — 2026-07-12