A new variant of the RedHook Android malware leverages Android's Wireless Debugging (Wireless ADB) to obtain shell‑level privileges without a computer connection. This technique enables the malware to stream screens, capture keystrokes and install apps silently, bypassing traditional defenses.

मुख्य बिंदु (Key Takeaways)

  • RedHook uses Wireless ADB to gain UID 2000 shell privileges
  • Malware employs the legitimate Shizuku framework to expand permissions
  • Works on all Android devices without requiring root

Cyber‑security firm Group‑IB has dissected the latest RedHook Android malware release and discovered that it now abuses the Android Wireless Debugging (Wireless ADB) mechanism in a novel way to achieve shell‑level access without any computer connection. Compared with the variant documented in 2025, this version significantly broadens its capabilities while retaining classic Remote Access Trojan (RAT) features such as screen streaming, keystroke interception, UI automation and credential theft.

Technical Background of Wireless ADB

ADB (Android Debug Bridge) is Google’s debugging interface that allows a user to control an Android device from a command line. Introduced in Android 11, Wireless ADB offers the same functionality over Wi‑Fi, eliminating the need for a USB cable. RedHook essentially transforms the infected phone into its own ADB client by coaxing the victim into granting Accessibility permissions, which it then uses to toggle Developer Options, enable Wireless Debugging, and manipulate system settings automatically.

Step‑by‑Step Attack Chain

Once Wireless Debugging is active, the malware reads the pairing code displayed on the screen and connects to the device’s ADB service via the loopback interface (127.0.0.1). After a successful pairing, RedHook obtains shell (UID 2000) privileges—far more powerful than those of ordinary Android apps, yet short of full root. Crucially, the entire chain works on any Android device without requiring root, provided the user is tricked into approving the Accessibility Service request.

Abusing the Shizuku Framework

RedHook then deploys a Shizuku‑based framework to execute shell commands, grant itself additional permissions, modify protected Android settings, silently install or remove applications, and perform a host of operations without showing user dialogs. Shizuku is a legitimate utility popular among power users and developers, and it does not need a rooted device. By loading Shizuku’s libmx.so as a privileged server, the malware invokes Android APIs as UID 2000, effectively acting as a privileged system component.

Capabilities and Persistence Mechanisms

According to Group‑IB’s report, the current variant supports 53 server‑issued commands, including:

  • Screen streaming and screenshot capture
  • Simulated taps, swipes, gestures, long‑clicks
  • Device lock/unlock
  • App install, launch and uninstall
  • Contact, SMS and app data collection
  • Creation of overlays or fake verification dialogs
  • Camera activation
  • Device reboot
Persistence is reinforced through silent audio playback to boost process priority, WakeLocks to prevent CPU sleep, mutual service restarts, a five‑minute watchdog alarm, automatic reboot‑time restart, and setting oom_score_adj to -1000 to reduce the likelihood of being killed under memory pressure.

Distribution Vector and User Recommendations

The latest RedHook campaign relies heavily on social engineering: attackers impersonate government agencies or financial institutions via messages and phone calls, directing victims to counterfeit Google Play sites. Android users are advised to install applications only from the official Google Play Store, scrutinize permission requests during installation, and keep Play Protect enabled at all times.