RedHook Android Trojan Automatically Enables Wireless ADB Debugging to Hijack Devices Without Root or User Interaction
The RedHook trojan, first described in July 2025, has received an unprecedented update that lets it independently enable wireless ADB debugging on compromised Android smartphones, achieving system-shell privileges without root or any action from the victim.
According to researchers at Group-IB, the infection follows a familiar social-engineering pattern. Attackers contact targets by phone or messenger, posing as bank or government representatives, and persuade them to download an application from a fake website styled to resemble an official app store. The malicious APK files themselves are hosted on legitimate infrastructure—GitHub repositories and Amazon S3 cloud storage—reducing the likelihood of detection by security solutions.
After installation, victims are convinced to grant the app accessibility-service permissions under the pretext of enabling full functionality. This single permission serves as the gateway to everything else. With accessibility access, RedHook automatically opens the device settings, taps the build number seven times to reveal the developer menu, and activates wireless debugging—all hidden behind a full-screen overlay.
The malware then runs its own ADB client, which connects directly to the phone’s local debugging server using the loopback address, eliminating any need for an external computer. The technique is built on code from the popular Shizuku framework that advanced users normally employ to extend app capabilities without root.
Once system-level privileges are obtained, RedHook can silently install or remove applications, alter protected settings, and grant itself additional permissions without triggering confirmation dialogs. To remain active as long as possible, the trojan employs several anti-termination tactics: it simulates an active foreground window, plays silent audio, prevents the CPU from sleeping, and blocks the system from killing its process under low-memory conditions.
Two service processes monitor each other and restart their counterpart if either is stopped. After a device reboot, a dedicated component automatically restores all privileges. Stolen data and live screen recordings are transmitted over encrypted connections to attacker-controlled servers; when system rights are already present, the malware can stream the screen without triggering the standard screen-recording permission prompt.
Observed campaigns remain focused on Southeast Asia, with infections confirmed in Vietnam and later in Indonesia. Experts advise installing applications exclusively from official stores, scrutinizing permission requests—especially accessibility access—and remaining wary of unsolicited contacts claiming to represent banks or government agencies.
Related articles
GOFFEE Dissects Custom COW Agent Forked from Poseidon Mythic Implant
Angara Security researchers uncovered a custom Go-based Mythic C2 agent named COW used by the Russian-oriented APT group GOFFEE, also known as Paper Werewolf. The agent represents an independent development branch derived from the public Poseidon project rather than its Freyja fork. Samples were heavily protected with Garble obfuscation and a modified UPX packer that required manual header reconstruction for unpacking. Analysis of surviving strings, build paths, and architectural features confirmed Poseidon origins while revealing numerous custom modifications including Windows support, additional C2 profiles, and new command implementations. The group employs the agent alongside other tools such as PowerTaskel, MiRat, and BindSycler for persistent access to Linux and Windows systems across government, energy, telecom, and defense targets. Researchers traced multiple variants through VirusTotal and incident reports, documenting evolutionary changes in configuration handling and peer-to-peer communication mechanisms.
Manic Android Malware Steals PINs via Transparent Overlay and Relays Data Through Nearby Infected Devices
A newly identified Android malware strain named Manic merges banking trojan, spyware, and remote access capabilities. The threat has been active since at least February 2026 and continues to receive updates that add anti-analysis features, in-memory code loading, and lock-screen credential theft. Manic monitors 169 financial, messaging, and government applications while using a transparent overlay on legitimate numeric keyboards to capture PINs without displaying a full fake banking screen. Stolen data can be forwarded through other compromised nearby devices even when the original phone lacks internet connectivity. Operators also leverage WebRTC sessions for live screen viewing and remote interaction. The malware additionally functions as a keylogger, intercepts SMS and notifications, and collects passwords, one-time codes, and recovery phrases. Security researchers recommend avoiding unknown APKs and scrutinizing requests for Accessibility Services or broad device control permissions.
Armored Likho Expands Arsenal with BusySnake RAT and AI-Driven Malware Development
The cybercrime group Armored Likho has introduced a new multi-platform trojan called BusySnake RAT that targets Windows, Linux, and macOS systems. Researchers at Kaspersky Lab identified three distinct versions of the malware, evolving from a Python implementation using Telegram bots for command-and-control to a GitLab-based variant and finally a fully rewritten Go version. In addition to custom development, the group has incorporated the open-source Kharon RAT to facilitate remote access and data exfiltration. Armored Likho has also shifted its infrastructure to private GitHub and GitLab repositories to hinder analysis. Most notably, the group now leverages large language models not only for initial access but also to generate tools for persistence and post-exploitation activities. Kaspersky security products continue to detect and block activity linked to the group.
Microsoft Removes WMIC from Windows 11 After Years of Abuse as LOLBIN by Ransomware and Attackers
Microsoft has begun permanently removing the legacy WMIC command-line utility from Windows 11, starting with versions 24H2 and 25H2. The tool is no longer available in fresh installations, has been dropped as an optional component, and is absent from the latest beta builds. WMIC provided text-based access to Windows Management Instrumentation for querying hardware, processes, services, and security software, as well as performing administrative tasks. Although the underlying WMI technology remains untouched, Microsoft has deprecated the command shell due to its long-standing use as a LOLBIN in cyberattacks. Ransomware operators have leveraged WMIC to delete shadow copies and hinder recovery, while other attackers used it to enumerate and disable security tools or add exclusions in Microsoft Defender. Administrators are directed to migrate to PowerShell, COM API, .NET libraries, and modern scripting languages, which will require rewriting legacy automation scripts.