RedHook Android RAT: A new step in Android device hijacking techniques

Campaign Summary

A report from Group-IB Threat Intelligence published on July 9, 2026 confirms the re-emergence of RedHook malware — a remote access Trojan (RAT) on Android with breakthrough improvements in privilege escalation techniques. Instead of exploiting complex zero-day vulnerabilities, RedHook automatically abuses the wireless debugging feature (Wireless ADB) available on Android combined with the open source Shizuku framework to hijack the shell (uid 2000) on the victim device.

This campaign tends to shift its target from Vietnam to Indonesia, targeting customers of financial applications and public services. Attackers use websites impersonating government services to trick victims into downloading malicious APK files stored directly on AWS S3 and GitHub to avoid common URL filtering mechanisms.

History and Development of RedHook

RedHook malware is not a completely new threat but is the result of a continuous technological evolution from previous financial attack campaigns.

Starting phase (July 2025)

RedHook was first publicly documented by security researchers from the company Cyble in July 2025. During this period, the malware operated as a regular Android Banking Trojan. Its central target is users in the Vietnamese market. Attackers distribute malicious code through websites impersonating Vietnamese government agencies (such as the General Department of Taxation) or large financial institutions, luring victims into downloading APK installation files directly (sideloading).

Technically, early versions of RedHook relied entirely on abusing Accessibility Service permissions to:

1. Collect sensitive information via Keylogging.

2. Read SMS messages to steal OTP codes.

3. Perform an Overlay attack by displaying fake login pages over legitimate banking applications to steal authentication information.

4. Stealing the pin code or pattern to unlock the screen.

Upgrade infrastructure and expand scale (Late 2025 - Early 2026)

By the end of 2025, the RedHook malware began to undergo a major upgrade in its control structure. Analysts discovered the malware has migrated from the traditional HTTP protocol to the real-time WebSocket protocol, allowing attackers to set up screen streaming and respond to remote control commands (C2 commands) with almost no latency.

At the same time, the campaign's goals are no longer limited to Vietnam. Localized variants of Bahasa Indonesia began appearing in the first quarter of 2026, indicating intent to expand the attack reach to other dynamic financial markets in the Southeast Asia region.

Breakthrough upgraded version (July 2026)

The latest version of RedHook recorded in mid-2026 shows a technical leap forward through the integration of Wireless ADB system debugging and the Shizuku open source framework. This combination marks the transition from a conventional banking RAT based on Accessibility Service to a malware that controls the device at the system shell level (uid 2000), opening up the possibility of completely bypassing Android's protection mechanisms.

Event timeline

RedHook was first noted by Cyble researchers in July 2025 as a banking malware targeting the Vietnamese market. Below is the development process and major milestones of this malware:

Timeline / Date	Event
07/2025	Cyble detected the first variant of RedHook targeting banking applications in Vietnam.
12/2025	The malware upgraded its C2 infrastructure, adding a real-time WebSocket communication mechanism.
Q1/2026	Malicious samples targeting users in Indonesia began to appear with localized phishing interfaces.
07/2026	Group-IB published a detailed analysis report on the techniques of abusing Wireless ADB and integrating Shizuku.
07/2026	FPT IS SOC recorded attempts to distribute malicious files using GitHub repositories and AWS S3.

Chain of Contamination and Social Engineering

Attackers use lure calls or messages via OTT applications (such as Zalo, Telegram) impersonating technical support staff or government agencies. Victims are instructed to visit phishing websites with an interface similar to the Google Play Store to download fake public service applications or security utilities.

Fake services and apk files are hosted by attackers on github

The attacker designed the "PUBLIC SERVICE" Application to deceive users

After the application is successfully installed, the malware displays phishing screens asking to enter account information, password and OTP code. The most important step is to trick the user into granting Accessibility Service permission through an intuitive wizard interface. This permission is a springboard for malware to automate privilege escalation operations in the following steps.

The infection chain will be executed according to the following model

Technical Anatomy Escalating Privileges: Wireless ADB & Shizuku

A special feature of RedHook is the mechanism to automatically gain system-level control (shell privilege - uid 2000) without needing to root the device or physically connect to the computer via USB cable.

Automatically enable Wireless ADB via Accessibility

After having Accessibility Service permission, RedHook will run a series of actions to simulate the user's gestures in the Settings section of the operating system:

1. Click Build Number 7 times continuously to activate Developer Options.

2. Go to Developer Options and find the Wireless Debugging section.

3. Enable the Wireless Debugging feature and tap the Pair device with pairing code option.

4. Directly read the system interface to extract the pairing code and random connection port.

During this process, the malware often displays a full-screen overlay to cover the victim's eyes, making all configuration operations take place completely anonymously in the background.

Set up self-hosting mechanism through Shizuku

Typically, the ADB debugging tool requires a computer to act as a client to send commands to the daemon (adbd) running on the phone. Shizuku solved this problem by taking advantage of local network connections. RedHook has a built-in native ADB client library.

Once the pairing code is present, the malware connects itself to the device's own adbd port via the loopback interface (127.0.0.1). As soon as the connection is successful, it sends a command to launch a privileged server process named libmx.so under the authority of the shell system user (uid 2000).

Through Binder IPC (Inter-Process Communication), the RAT application communicates directly with the libmx.so process to execute privileged tasks:

1. Automatically grant dangerous runtime permissions without displaying a system confirmation dialog.

2. Execute arbitrary shell commands directly with uid 2000 privileges.

3. Capture low-level touch events of the system.

4. Override configuration in Settings.Secure via WRITE_SECURE_SETTINGS permission.

The malicious code also contains individual optimization codes for each ROM of major OEMs such as Google, Huawei, Meizu, Oppo, Samsung, Vivo and Xiaomi to automatically enable Wireless ADB depending on the Settings structure of each model.

Analyzing the Persistence Stack

To avoid having Android's battery optimization and memory management mechanisms disabled when the device enters an idle state, RedHook builds an extremely resilient presence:

1. 1x1 pixel hidden screen (One-pixel Activity): When detecting that the device screen is off, the malicious code launches an almost invisible 1x1 pixel Activity. This mechanism forces Android to identify the application running in the foreground process, preventing the process from being released.

2. Play Silent Audio: The RAT continuously runs a service that plays silent audio through the MediaSession class. Music playback progress is always kept in memory with priority.

3. WakeLock: Keeps the device's CPU running continuously, not entering a deep sleep state.

4. Cross-process Mutual Resurrection: RedHook splits the source code into two separate service processes. These two processes are linked together using the bindService() function with the BIND_AUTO_CREATE flag. When a process is killed by the system or antivirus software, the remaining process detects it through the onServiceDisconnected() event and immediately relaunches the other process.

5. Alarm Manager: Set up a periodic check event every 5 minutes to wake up and restore services if both processes are interrupted at the same time.

6. OOM Score Adjustment: The malware attempts to write the lowest priority value -1000 to the system configuration file /proc//oom_score_adj. This is the value that exempts the process from Android's RAM release filter (Out-Of-Memory killer).

7. mlock() and Memory Pinning: Use the mlock() system call to pin an allocated physical RAM memory area, prevent the operating system from putting this memory area into swap memory on the disk, and periodically overwrite data on this memory area to signal an active process.

C2 Control Infrastructure and Monitoring Capabilities

The malware uses the encrypted WebSocket protocol to maintain a real-time two-way communication channel with the control server (C2). Data stolen from the device (passwords, contacts, SMS messages) is sent through specific Rest API endpoints.

Endpoints transmit data

Endpoint	Purpose
/auth/login	Send initial login credentials collected from the victim.
/file/upload	Upload screenshots to the C2 server.
/member/info/addDevice	Update detailed information about the device's hardware configuration.
/member/info/addDevicePassword	Upload collected screen unlock passwords/PINs.
/member/info/addsKeyboardInput	Send keylogger data collected from keyboard inputs.
/member/info/addMessage	Exfiltrate SMS data (to capture transaction OTP codes).
/member/identity_verification/saveSecurityCode	Collect security verification codes manually entered by the user.

Parallel Screen Streaming mechanism

Typically, Android apps use the MediaProjection API to stream the screen, which requires displaying a dialog box that alerts the user.

However, upon obtaining the uid 2000 shell privilege from Shizuku, RedHook launches a second parallel stream via the RTMP protocol. This stream reads data directly from the system's framebuffer at a low-level, allowing the attacker to monitor the victim's screen in real time without triggering any warning dialog or screen recording icon in the status bar.

Statistics of command table C2

The malicious code supports up to 53 remote control commands structured with specific numbers sent via WebSocket. Here are the notable commands:

Command Code	Technical Description
10002	Simulate screen swipe gesture.
10003	Simulate a click at a specific coordinate.
10004	Create a fake screen overlay.
10007	Retrieve the list of all installed applications on the device.
10008	Retrieve the entire SMS message history.
10010	Download and silently install a new APK file (via shell permissions).
10011	Uninstall a specified application.
10020 / 10021	Lock and unlock the device screen.
10023	Display a fake facial authentication screen and auto-activate the front camera to capture a portrait photo (to bypass banking apps' eKYC mechanisms).
10028	Disable the system's Accessibility feature.
10047	Activate the anti-uninstall mechanism.
10050 / 10051	Configure and establish a wireless ADB connection.
10054	Automatically grant a series of sensitive permissions to the malware.
99999	Remove the malicious mx_server helper library from the system to erase traces.

Expert Comments

RedHook's Wireless ADB and Shizuku abuse techniques represent a new development in mobile malware in Southeast Asia. Previously, banking malware mainly depended on Accessibility permission to execute overlay attacks or steal OTPs. The switch to exploiting the Wireless ADB feature shows that attackers have found an optimal way to gain system privileges (shell privilege) without needing to jailbreak the device (root) or exploit OS vulnerabilities. This type of Zero-Exploit Privilege Escalation attack is extremely dangerous because it completely uses legitimate features of the operating system.

The shift in targets and expansion of operating areas from Vietnam to neighboring countries such as Indonesia shows that this malware operating group is operating according to a professional model, continuously optimizing distribution infrastructure (using GitHub, AWS S3 to hide malicious traffic) and localized phishing interface. Financial institutions in Vietnam need to immediately update the identifying signs of this malware variant into the transaction monitoring system.

Defensive recommendation

For financial institutions and banks

• Immediate (0-24h): Update the list of detected network IOCs and malicious application package names to the organization's Threat Intelligence system.

• Short-term (1-7 days): Deploy or upgrade user session monitoring solutions (such as Fraud Protection/RASP) capable of detecting devices running ADB debug processes or the presence of the Shizuku framework in the application runtime environment.

• Long-term: Integrates overlay detection mechanism and checks the integrity of the application running environment (Device Attestation API) before allowing sensitive transactions.

For personal use

• Immediate (0-24h): Go to Settings -> Developer Options and completely turn off Wireless Debugging as well as USB Debugging. If there is no need for application development, turn off Developer Options completely.

• Short-term (1-7 days): Check the list of applications that have granted Accessibility Service permission in the Settings section. Disable this permission for all unfamiliar applications, especially applications installed from APK files downloaded from the Google Play Store.

• Long-term: Only install applications from official sources. Be wary of any requests for instructions on installing banking or public service applications from unknown phone numbers or OTT messages.

IOC

File Hash (SHA-256)

• 453333bffdd1850ea2e0647f7c805530b578919978a01b1e2be52d6eb2add946

Network indicators

• api.3n7wj[.]com

• skt.3n7wj[.]com

• sktv.3n7wj[.]com

• hxxps://api.3n7wj[.]com

• wss://skt.3n7wj[.]com

• wss://sktv.3n7wj[.]com

Reference

RedHook Returns with a Dangerous Upgrade | Group-IB Blog

RedHook Returns with a Dangerous Upgrade - Live Threat Intelligence - Threat Radar | OffSeq.com

RedHook Android RAT Abuses ADB Wireless Debugging to Gain Shell-Level Access

RedHook Android malware now uses Wireless ADB for shell access