Android Malware RedHook Learned A Wireless Trick To Secretly Hijack Your Device

Cyber criminals are constantly looking for new ways to compromise systems and devices, and sometimes that means going back to the well with malware that’s been successful in the past. That’s exactly what the researchers at security firm Group-IB observed with RedHook, which originally appeared in 2025, but has been renewed with some new tricks up its sleeve.

RedHook is a Remote Access Trojan (RAT) that’s aimed at the Android ecosystem, which provides attackers with a full suite of tools to maximize the theft of a victim’s data. This includes the ability to record a device’s screen and log what a user inputs with their keyboard. Additionally, it can steal sms messages, a victim’s contacts, lock and unlock the compromised device, and take pictures of the victim using the front facing camera.


While these capabilities have been offered by other malicious software in the past, the researchers note that RedHook does provide some novel capabilities by leveraging Android Debug Bridge (ADB). It’s a feature that’s often used by developers while testing applications, and in this case, ADB Wireless Debugging paves the way to gaining elevated privileges on the victim’s device.

Alongside commandeering the wireless debugging feature, RedHook repurposes code from Shizuku, which is an open source framework that enables apps to have elevated privileges without needing root access. It allows the malicious software to run a privileged ADB shell on the device itself, eliminating the need for a PC or USB cable in the process.

Once installed on a victim’s device this malware has a whole host of options to remain installed on a victim’s device. It’s able to evade Android's security features by playing silent audio, launching a tiny 1x1 pixel, prevent from the CPU from sleeping and will auto start itself as a process after the device has been rebooted. Making it a tough piece of malware for a victim to deal with.

For now, RedHook has mostly been targeting users in Southeast Asia, but hackers in other parts of the world will likely take notice and try to use it in their own home regions. Users should always stick to their platform’s app store when downloading new apps to reduce the risk of being victimized.