RedHook Android malware gains shell access via Wireless ADB in new variant

Group-IB researchers detail an updated RedHook Android malware that abuses Wireless ADB to gain shell privileges without root, using Shizuku to execute commands and maintain persistence.

This article was drafted with AI assistance from multiple sources and was reviewed and approved by a human editor before publication.

Cybersecurity firm Group-IB has published an analysis of a new version of the RedHook Android malware that exploits the Wireless Debugging (Wireless ADB) feature to obtain shell-level access. Unlike earlier iterations documented in 2025, this variant does not require a physical USB connection to a computer.

The attack begins by tricking the user into granting Accessibility permissions, which the malware then uses to automatically enable Developer Options and activate Wireless Debugging on the device. Once Wireless ADB is active, RedHook reads the pairing code displayed on the screen and establishes a connection to the device's own ADB service via the loopback address 127.0.0.1. After pairing, the malware obtains shell privileges at UID 2000 — a level that exceeds standard app permissions but is not equivalent to root. The entire chain works on unrooted devices, as long as the user approves the Accessibility Service prompt.

With shell access, RedHook deploys a framework based on Shizuku, a legitimate tool used by developers and power users that does not require root. The framework, identified as libmx.so, acts as a privileged server to invoke Android APIs at UID 2000. This allows the malware to execute shell commands, grant itself additional permissions, modify protected system settings, install or remove apps without user interaction, and perform various other operations. According to Group-IB, the current version supports 53 distinct server-issued commands.

RedHook retains its remote access trojan (RAT) functionality, including screen streaming, keystroke logging, UI automation, and credential theft. To ensure it remains active, the malware employs several persistence techniques: it plays silent audio to increase its process priority, uses WakeLocks to keep the CPU from sleeping, and runs two services that restart each other if one is killed. Additional measures include a five-minute watchdog timer, automatic restart after the device boots, and setting the oom_score_adj value to -1000 to lower the chance of being terminated when memory is scarce.

Distribution of this RedHook variant relies on social engineering, Group-IB reports. Attackers pose as government agencies or financial institutions in messages and phone calls, directing victims to fraudulent websites that mimic Google Play. The researchers advise Android users to download apps exclusively from the official Google Play store, review permission requests carefully, and ensure that Play Protect is enabled on their devices.