RedHook Android Malware Abuses Wireless ADB for Shell Access
Summary
Group-IB says a new RedHook Android variant tricks users into enabling Wireless Debugging, pairs over loopback, and uses Shizuku for shell-level commands. It retains RAT capabilities and is spread through impersonation and fake app sites.
Key points
- RedHook uses Accessibility permissions to manipulate Settings, enable Developer Options, and activate Wireless Debugging.
- It retrieves the displayed pairing code and connects to the device’s ADB service through the loopback interface, gaining shell privileges as UID 2000—not root.
- The malware uses Shizuku to run privileged Android commands, grant additional permissions, change protected settings, and silently install or remove apps.
- Group-IB reports capabilities including screen streaming, input simulation, data collection, camera activation, and fake verification dialogs.
- Persistence methods include services that restart each other, watchdog alarms, restart after boot, WakeLocks, and silent audio playback.
- Attackers reportedly use impersonation of government agencies or financial institutions to direct victims to fake Google Play sites; users are advised to review permissions and keep Play Protect active.
Article Details
- Attack Vectors
- Attackers reportedly impersonate government agencies or financial institutions in messages and phone calls, directing victims to fake Google Play sites to distribute RedHook.
- RedHook tricks users into granting Accessibility permissions, then uses them to enable Developer Options and Wireless Debugging.
- The malware retrieves the displayed ADB pairing code and pairs with the device’s ADB service over the loopback interface, gaining shell-level privileges.
- RedHook uses Shizuku to run privileged commands, including silently installing or removing apps and modifying protected Android settings.
- Its RAT capabilities include screen streaming, keystroke interception, UI automation, credential theft, data collection, and fake verification dialogs.
- Defensive Notes
- Install apps only from Google Play.
- Scrutinize requested permissions during installation, especially Accessibility Service permission requests.
- Ensure that Play Protect is active on the device.
MITRE ATT&CK
T1417.001The article reports that RedHook intercepts keystrokes to steal credentials.T1513RedHook can stream the device screen and capture screenshots.T1624.001RedHook is reported to restart automatically after device boot.T1626.001RedHook abuses Accessibility permissions to manipulate Settings and enable Developer Options and Wireless Debugging.
Malware
Products
AndroidRedHook is a new Android malware version that abuses Wireless ADB in a novel way to gain shell-level privileges without needing a computer connection.Google PlayIt retains powerful RAT features and is spread through social engineering that impersonates government agencies or financial institutions to lure victims to fake Google Play sites.