{"id":17973,"date":"2026-07-12T08:44:48","date_gmt":"2026-07-12T15:44:48","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=17973"},"modified":"2026-07-12T08:44:48","modified_gmt":"2026-07-12T15:44:48","slug":"redhook-android-malware-now-uses-wireless-adb-for-shell-access","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2026\/07\/12\/redhook-android-malware-now-uses-wireless-adb-for-shell-access\/","title":{"rendered":"Redhook Android Malware Now Uses Wireless ADB for Shell Access"},"content":{"rendered":"\n

Good to be aware of as you have to grant the malware rights, if you failed to pickup the social phishing scheme to add the malware to your phone in the first place. This setting is in developer settings if enabled on your phone. I just started playing with adb and fastboot again while waiting for Motorola to unlock a phone I just purchased, and it seems Android is trying some sneaky tactics to keep people from using alternative operating systems, where you can trigger an anti-rollback security feature<\/a> when trying to lock the bootloader after install. And next year we should have a Motorola phone with preinstalled Graphene OS which is much more secure than stock Android and available ROMs. Though in the meantime I’m going to experiment with LineageOS<\/a> and CalysOS<\/a>. IodeOS<\/a> and \/e\/OS\/<\/a> might be worth a look as well. Some of these have easier web based installers now (Chrome based browser) which might make the process much easier.<\/p>\n\n\n\n

https:\/\/www.bleepingcomputer.com\/news\/security\/redhook-android-malware-now-uses-wireless-adb-for-shell-access\/<\/a><\/p>\n\n\n

<\/div><\/div><\/div>\n\n\n

By Bill Toulas<\/p>\n\n\n\n

\"Android\"\/<\/figure>\n\n\n\n

A new version of the RedHook Android malware abuses the Android Wireless Debugging (Wireless ADB) mechanism in a novel way to gain shell-level privileges without requiring a computer connection.<\/p>\n\n\n\n

Researchers at cybersecurity company Group-IB analyzed the new release of the mobile malware and say that it significantly expands its capabilities compared to the previous variant documented in 2025.<\/p>\n\n\n\n

At the same time, the malware retains its remote access trojan (RAT) features, allowing it to stream the screen, intercept keystrokes, automate UI interactions, and steal credentials.<\/p>\n\n\n\n

Autonomous Wireless ADB abuse<\/h3>\n\n\n\n

ADB (Android Debug Bridge) is Google’s debugging interface that lets a user control an Android device from a command line.<\/p>\n\n\n\n

The system, which runs on an Android device as an ADB daemon, enables executing shell commands from a computer running the ADB client.<\/p>\n\n\n\n

Wireless ADB, first introduced in Android 11, provides the same capability wirelessly, without requiring the devices to be linked via a USB cable.<\/p>\n\n\n\n

RedHook essentially turns the phone into its own ADB client by tricking the victim into granting it Accessibility permissions, which let it automatically manipulate Settings, enable Developer Options, and activate Wireless Debugging.<\/p>\n\n\n\n

After that, the malware retrieves the pairing code displayed on the screen and connects to the phone\u2019s ADB service via the loopback interface (127.0.0.1).<\/p>\n\n\n\n

Once paired, the malware gains shell (UID 2000) privileges, which are significantly more powerful than those available to normal Android apps, though not root-level.<\/p>\n\n\n\n

The entire attack chain does not require the device to be rooted, so it works across all Android devices as long as the user is tricked into approving the Accessibility Service permission request.<\/p>\n\n\n\n

Next, the malware deploys a Shizuku-based framework to execute shell commands, grant itself additional permissions, modify protected Android settings, silently install or remove applications, and perform various operations without displaying user dialogs.<\/p>\n\n\n\n

Shizuku is a legitimate Android utility popular among power users and developers, and does not require a rooted device.<\/p>\n\n\n\n

RedHook executes Shizuku code as part of its attack chain, using it as a privileged server (libmx.so) to invoke privileged Android APIs as UID 2000.<\/p>\n\n\n\n

\"Attack
RedHook malware attack chain<\/strong>
Source: Group-IB<\/em><\/figcaption><\/figure>\n\n\n\n

According to Group-IB’s report<\/a>, the current version of the malware supports 53 server-issued commands, which include:<\/p>\n\n\n\n