RedHook Malware Uses Wireless ADB to Gain Powerful Android Shell Access

Researchers have identified a new version of RedHook malware that abuses Android’s Wireless Debugging feature to obtain shell-level privileges without requiring a USB connection or a rooted device.

The updated malware builds on earlier versions by combining Wireless Android Debug Bridge (ADB) abuse with its existing remote access capabilities. As a result, attackers can gain far greater control over infected devices.

Malware Exploits Wireless ADB

Android Debug Bridge (ADB) is Google’s debugging interface that allows developers to execute commands on Android devices.

Wireless ADB, introduced in Android 11, provides the same functionality without requiring a USB cable.

The latest RedHook malware tricks victims into granting Accessibility Service permissions. Once approved, the malware automatically navigates Android settings, enables Developer Options, and turns on Wireless Debugging.

It then reads the pairing code displayed on the screen and connects to the device’s ADB service through the local loopback interface.

This process gives the malware shell-level privileges (UID 2000), providing significantly more access than a normal Android application without requiring root access.

Shizuku Expands the Malware’s Capabilities

After gaining shell access, RedHook deploys a framework based on Shizuku, a legitimate Android utility commonly used by developers and advanced users.

The malware abuses Shizuku to execute privileged shell commands and access protected Android APIs.

This allows attackers to grant additional permissions, modify protected system settings, silently install or remove applications, and perform other privileged operations without displaying confirmation dialogs.

Remote Access Features Continue to Grow

Researchers say the latest RedHook malware supports 53 commands issued by its command-and-control server.

These capabilities include:

• Streaming the device screen and capturing screenshots
• Simulating taps, swipes, gestures, long presses, and drag actions
• Locking or unlocking the device
• Installing, launching, and uninstalling applications
• Collecting contacts, SMS messages, and installed app information
• Displaying fake overlays and verification dialogs
• Activating the device camera
• Rebooting the device

Combined with its elevated privileges, these features give attackers extensive control over compromised phones.

Malware Uses Multiple Persistence Techniques

The updated malware also includes several mechanisms designed to remain active on infected devices.

It plays silent audio to increase process priority and uses WakeLocks to prevent the processor from entering sleep mode. Two background services continuously restart one another if either process is terminated.

Additional persistence methods include a watchdog timer that runs every five minutes, automatic startup after the device reboots, and memory management adjustments that reduce the likelihood of the malware being terminated when system resources are low.

Users Are Tricked Through Fake App Downloads

Researchers say attackers distribute the latest RedHook malware through social engineering campaigns.

Victims receive phone calls or messages from criminals impersonating government agencies or financial institutions. They are then directed to fake Google Play websites where they download the malicious application.

Android users should install apps only from the official Google Play Store, carefully review requested permissions before granting them, and ensure Google Play Protect remains enabled to help detect malicious software.