The latest RedHook Android malware variant shows how attackers are abusing legitimate developer features to gain deeper control over mobile devices.

RedHook now uses Android Wireless Debugging, also known as wireless ADB, to obtain shell-level access without needing a physical computer connection. By tricking users into granting Accessibility permissions, the malware can enable wireless debugging, pair with itself, and execute shell commands directly on the infected phone.

This is dangerous because shell access gives malware far more control than ordinary app permissions. It can support surveillance, data theft, banking fraud, screen capture, remote control, and manipulation of security settings. RedHook also retains remote-access capabilities and supports dozens of commands, making it more than a simple banking trojan.

The attack shows how social engineering remains central to mobile malware. Instead of relying only on technical exploits, attackers guide users through steps that grant the malware powerful access. Apparently, criminals have realized that the easiest privilege escalation is still convincing a human to tap the wrong button.

Users should avoid installing apps from fake Google Play pages, unknown websites, messaging links, or unofficial stores. Android devices should keep Developer Options and Wireless Debugging disabled unless actively needed, and Accessibility permissions should be granted only to trusted apps with a clear purpose.

Organizations managing Android devices should enforce mobile device management policies, block sideloading where possible, monitor risky permissions, and detect unusual ADB or accessibility activity.

The key lesson is that developer features are powerful because they are meant to control devices. When malware abuses those features, the phone can become less like a personal device and more like a remotely operated endpoint.

A new version of the RedHook Android malware abuses the Android Wireless Debugging (Wireless ADB) mechanism in a novel way to gain shell-level privileges without requiring a computer connection. [...]

Source: RedHook Android malware now uses Wireless ADB for shell access via Bleeping Computer — published 12 Jul 2026.