July 12, 2026
Group-IB researchers have uncovered a major upgrade to the RedHook Android malware that abuses Wireless ADB to gain shell privileges on devices without needing a computer connection. Consequently, the threat significantly expands what attackers can steal and control on infected Android phones.
What Happened: RedHook Android Malware Upgrades to Wireless ADB Attack
RedHook is a remote access trojan (RAT) that first surfaced in 2025. Moreover, it has now returned with a dangerous new capability. The malware tricks victims into granting Accessibility permissions. It then automatically enables Developer Options and activates Wireless ADB. Furthermore, it pairs itself with the device via the loopback interface.
Once paired, RedHook gains shell privileges (UID 2000) through the Android Debug Bridge daemon. For example, it can install apps, modify protected settings, and remove programs without showing user dialogs. Therefore, the attack works across all Android devices without requiring root access.
Technical Details of the RedHook Wireless ADB Exploit
The malware follows a multi-stage attack chain:
- Social engineering lures victims through fake messages and calls impersonating government or financial institutions
- Victims are directed to fake Google Play sites to install the malicious app
- The app requests Accessibility Service permissions, which allow automated manipulation of device settings
- Developer Options and Wireless Debugging are silently enabled
- The malware retrieves the pairing code from the screen and connects to ADB via 127.0.0.1
- Shell access (UID 2000) is achieved through the legitimate ADB daemon
- A Shizuku-based framework is deployed to invoke privileged Android APIs
Moreover, RedHook executes Shizuku code as a privileged server (libmx.so). This grants it access to 53 server-issued commands, including:
- Screen streaming and screenshot capture
- Simulated taps, swipes, gestures, and long clicks
- Device locking and unlocking
- Installing, launching, and uninstalling apps
- Collecting contacts, SMS, and applications
- Creating overlays or fake verification dialogs
- Activating the camera
- Rebooting the device
Persistence Mechanisms Keep RedHook Alive
The malware employs multiple persistence techniques. For example, it uses silent audio playback to increase process priority and WakeLocks to prevent CPU sleep. Also, it sets oom_score_adj to -1000 to avoid being killed during low memory conditions. Furthermore, two services restart each other when one is terminated, and a five-minute watchdog alarm triggers automatic restart.
Business and Operational Impact
The RedHook Android malware poses serious risks to both individuals and enterprises:
- Credential theft: Intercepted keystrokes and fake overlays steal banking and corporate login credentials
- Corporate data exposure: Screen streaming and file access exfiltrate sensitive business data
- Financial fraud: Automated UI interactions enable unauthorized transactions
- Device takeover: Full remote control allows attackers to install additional malware
- BYOD risk: Employees using personal Android devices for work increase organizational exposure
Mitigation and Recommendations
Immediate Actions for Android Users
- Install apps only from the official Google Play store
- Review Accessibility permissions carefully — never grant them to unknown apps
- Ensure Google Play Protect is active and updated
- Check Developer Options and disable Wireless Debugging if not needed
- Monitor for unusual app installations and battery drain
Recommendations for Enterprise Security Teams
Organizations with BYOD policies should enforce mobile device management (MDM) controls. For example, restrict app sideloading and monitor for Accessibility service abuse. Also, security awareness training should cover social engineering tactics used by mobile malware distributors.
Bottom line: RedHook’s Wireless ADB abuse is a novel attack technique that bypasses traditional Android security boundaries. Therefore, users and enterprises must treat Accessibility permissions as highly sensitive and restrict Wireless Debugging in corporate environments.
Incident Summary
| Threat Name: | RedHook Android RAT |
| Attack Vector: | Social engineering, fake Google Play sites, Accessibility permission abuse, Wireless ADB exploitation |
| Disclosure Date: | July 12, 2026 |
| Researcher: | Group-IB |
| Affected Platform: | All Android devices (non-rooted) |
| Privilege Level: | Shell (UID 2000) via ADB daemon |
| Persistence: | Audio playback priority, WakeLocks, watchdog alarm, service mutual restart, oom_score_adj |
| Distribution: | Social engineering via fake messages and calls |
References
- Group-IB, “RedHook Returns with a Dangerous Upgrade,” July 2026, https://www.group-ib.com/blog/redhook-android-rat-upgraded/, accessed July 12, 2026.
- BleepingComputer, “RedHook Android malware now uses Wireless ADB for shell access,” July 12, 2026, https://www.bleepingcomputer.com/news/security/redhook-android-malware-now-uses-wireless-adb-for-shell-access/, accessed July 12, 2026.
