RedHook Android Trojan Automatically Enables Wireless ADB Debugging to Hijack Devices Without Root or User Interaction
The RedHook trojan, first identified in July 2025, has gained a novel capability that allows it to independently activate wireless ADB debugging on infected Android devices, granting system-shell privileges without requiring root access or any victim interaction. Infection begins through social engineering calls or messages impersonating bank or government officials, tricking users into installing malicious APKs hosted on legitimate platforms such as GitHub repositories and Amazon S3 storage. Once installed, the malware obtains accessibility service permissions and then silently navigates device settings, taps the build number seven times to unlock developer options, and enables wireless debugging. Leveraging code derived from the popular Shizuku tool, RedHook launches its own ADB client to connect directly to the local debugging server, bypassing the need for a computer. With elevated privileges, the trojan can install or uninstall applications, modify protected settings, grant itself permissions, and exfiltrate data and screen recordings over encrypted channels while employing multiple persistence techniques including mutual process resurrection and post-reboot restoration. Attacks have so far been concentrated in Southeast Asia, particularly Vietnam and Indonesia. Security experts recommend installing apps only from official stores and exercising caution with accessibility permission requests.
securitylab_n•Malware & Botnets
