A notorious Android banking trojan known as RedHook has resurfaced, utilizing a legitimate developer tool to gain unauthorized control over infected devices. This malware exploits ADB Wireless Debugging, a feature intended for app developers, to secure system-level access without the need for complex hacks.
RedHook’s New Exploit Strategy
RedHook’s latest iteration represents a significant escalation from its previous forms, which primarily focused on screen monitoring and keystroke logging. Originally detected by Cyble researchers in July 2025, the malware now incorporates Shizuku’s open-source code, a tool popular among Android enthusiasts for unlocking advanced permissions without rooting the device.
By leveraging these techniques, RedHook can surreptitiously install applications, alter secure settings, and grant itself extensive permissions without user consent. This enhanced capability allows the malware to operate with a level of sophistication not seen in earlier versions.
Wider Targeting Across Southeast Asia
Group-IB, in a report shared with Cyber Security News, highlighted that RedHook’s reach has expanded beyond its initial focus on Vietnam to include users in Indonesia, suggesting a broader campaign within Southeast Asia. The malware spreads through social engineering tactics, with attackers impersonating officials or bank representatives through phone calls and messaging apps.
Victims are often directed to deceptive websites mimicking the Google Play Store, where they are tricked into downloading a malicious APK. Once installed, the app deceives users into enabling the Accessibility Service, under the guise of a necessary step for proper app functionality.
Technical Mechanisms and Countermeasures
RedHook transforms the Android Debug Bridge (ADB) and its Wireless Debugging feature into a tool for malicious activity. It uses automated taps through the Accessibility Service to enable Developer Options, activate Wireless Debugging, and pair itself as an authorized device, all under a cloaked overlay that keeps users unaware.
Once established, the malware operates a privileged shell process, allowing it to install or remove apps, modify secure settings, and capture touch inputs without user approval. Its resilience strategy includes maintaining activity with a one-pixel screen display, silent audio, and wake locks to avoid shutdown by battery-saving modes.
For communication, RedHook utilizes WebSocket connections for command delivery and screen streaming, while larger data transfers are sent to specific web addresses. The malware’s capabilities extend to video streaming over RTMP, bypassing regular Android consent prompts.
Recommendations for Mitigation
Group-IB advises financial institutions to adopt session monitoring and digital risk protection to detect malware activity and fake websites. Individual users are encouraged to avoid unfamiliar links, install apps only from official sources, and treat requests for Accessibility Service permissions with caution.
As RedHook demonstrates the potential for developer tools to be repurposed for malicious purposes, increased scrutiny of features like Accessibility and Wireless Debugging is essential. Ongoing vigilance is necessary as cyber threats continue to evolve.
