Android RAT RedHook Uses Wireless ADB to Silently Grant Permissions and Control Devices

The RedHook Android Remote Access Trojan (RAT) has resurfaced with alarming new capabilities, marking a significant evolution in mobile malware.

First identified by cybersecurity researchers in July 2025 targeting users in Vietnam, the threat has now expanded its campaign into Indonesia.

While older versions relied on standard features like keylogging and credential theft, the latest variants have adopted a highly sophisticated approach to privilege abuse.

By weaponizing Android’s built-in debugging features, RedHook can now take complete autonomous control over a victim’s smartphone.

RedHook’s most dangerous new feature is its ability to hijack Android Debug Bridge (ADB) Wireless Debugging. ADB is a legitimate developer tool designed for testing applications and modifying file systems.

Typically, this requires a physical USB connection to a computer. However, RedHook exploits the wireless version of this feature to gain shell-level privileges (uid 2000) entirely on the device, bypassing the need for a PC or root access.

RedHook Abuses Wireless ADB

The infection chain begins with social engineering. Victims are tricked into downloading malicious APK files from spoofed government or financial websites hosted on legitimate platforms like GitHub and Amazon S3.

Once installed, the malware guides the user to grant it Accessibility permissions. Using these permissions, RedHook operates in the background, simulating user taps to navigate the device’s settings.

It automatically taps the operating system’s build number seven times to unlock Developer Options, enables Wireless Debugging, and extracts the necessary pairing code without the user ever noticing.

Once Wireless Debugging is active, RedHook uses an embedded ADB client to connect to the device’s own local network loopback interface.

It then leverages code from Shizuku, a popular open-source framework, to launch a privileged server process.

This grants the malware the ability to grant itself runtime permissions, execute shell commands, and silently install or uninstall other applications without triggering any security prompts or user confirmation dialogs.

Command Table

Beyond its privilege-escalation tactics, RedHook employs an incredibly stubborn, multi-layered persistence stack to ensure it remains active.

Android’s operating system typically shuts down background apps to conserve battery life. However, RedHook uses several clever tricks to avoid this fate.

For example, it launches a nearly invisible 1×1 pixel activity on the screen. This tricks the operating system into classifying the malware as a high-priority foreground application, shielding it from memory management sweeps, group-ib said.

The malware also plays silent audio in the background. It modifies its memory management score to the lowest possible value, ensuring the system never targets it for termination.

Furthermore, RedHook employs a mutual-resurrection loop using two cross-process-bound services.

If the operating system manages to kill one of the malware’s processes, the surviving service immediately detects the disconnection and restarts its partner. Both processes would have to be terminated simultaneously to stop the malware permanently.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.