RedHook Malware Hijacks Android Phones With 53 Commands via Wireless Debugging

3 articles · Updated · Fox News · Jul 20

Group-IB said the latest RedHook variant can gain shell-level access on Android phones, letting attackers control apps, capture credentials and steal data without full root access.
Wireless Debugging is the key escalation path: after victims sideload a fake app and grant Accessibility access, RedHook enables Developer Options, pairs with Android Debug Bridge over 127.0.0.1 and unlocks deeper system control.
53 commands in the current version allow screen streaming, keystroke logging, contact and SMS theft, silent app installs or removals, camera activation and fake overlays that can hide banking or identity-check fraud.
Persistence features make cleanup difficult — including silent audio, WakeLocks, watchdog services, reboot restart and memory-priority tweaks — so simply swiping the app away may not stop it.
Researchers said the attack still depends on social engineering, often through AI-powered phishing pages and urgent calls; users are urged to avoid APK sideloading, scrutinize Accessibility requests and keep Play Protect enabled.

Sources

Fox News14h ago

RedHook Android Malware Exploits Wireless Debugging to Hijack Phones, Steal Data

newswav.com20h ago

RedHook Android malware returns upgraded, targeting users across Southeast Asia - Newswav

linkedin14h ago

RedHook Android malware now uses Wireless ADB for shell access | James Cullimore

4 Sources

Is Google's plan to delay app installs a security solution or a move to control Android's open platform?

When AI can perfectly mimic trusted websites, how can anyone reliably spot a sophisticated phishing scam anymore?

As 'phishing-for-dummies' kits proliferate, is the era of the low-skill, high-impact cybercriminal now upon us?

RedHook Malware Escalates Android Threat: 3.9 Billion Devices at Risk from Wireless ADB Exploit in 2026

Overview

In July 2026, a powerful new version of the Android malware RedHook emerged, marking a new era in mobile threats. RedHook stands out by gaining shell-level access to Android devices without needing root or a physical connection. It achieves this by exploiting Android’s Wireless Debugging (Wireless ADB) feature, enabling Developer Options and activating Wireless ADB through automated user interface steps. By carefully navigating device settings and toggling the right options, RedHook gives attackers deep remote control, making it much harder to detect and remove. This escalation highlights a major shift in how Android devices can be compromised.

...