RedHook Android malware can quietly hijack your phone

Your telephone rings, and the caller sounds official. They accidental your slope relationship oregon authorities work needs contiguous verification. A nexus arrives moments later. The leafage looks similar Google Play, and the caller tells you to instal an app to hole the problem. Then the app asks you to crook connected Accessibility access, a almighty Android support that tin fto an app work the surface and power taps.

That support tin springiness the latest RedHook Android malware acold much power than a regular app should have. Researchers astatine Group—IB, a planetary cybersecurity institution that investigates online fraud and integer crime, analyzed the caller threat. They accidental the upgraded distant entree trojan, a benignant of malware that lets criminals power a instrumentality remotely, abuses Android's Wireless Debugging diagnostic to summation shell-level privileges. That means it tin tally almighty strategy commands and alteration protected settings that mean apps cannot access, though it does not summation afloat basal control.

RedHook tin past ticker the screen, grounds what you type, run apps and bargain login information. The caller method besides helps it instal oregon region apps without showing the accustomed support prompts. That makes 1 rushed support determination particularly costly.

Free unrecorded CyberGuy class: Sick of Spam? Join america July 22

Join america Wednesday, July 22, astatine 1 p.m. ET for a escaped CyberGuy Live people that volition assistance you chopped down connected robocalls, spam texts, junk email and different unwanted messages. Kurt "CyberGuy" Knutsson volition locomotion you measurement by measurement done elemental ways to filter spam, cleanable up your inbox and admit the messages that could enactment your idiosyncratic accusation astatine risk. No method acquisition is needed. You’ll besides person our spam-stopping checklist, and each registrant volition get a nexus to the people signaling afterward.

Reserve your escaped spot contiguous astatine CyberGuyLive.com.

NEW BANK SCAM LAWS COULD STOP SUSPICIOUS PAYMENTS

Cybersecurity researchers pass that RedHook Android malware tin prehend extended power of a telephone aft users instal a malicious app and alteration Accessibility permissions. (Photographer: Chris Goodney/Bloomberg via Getty Images)

RedHook Android malware starts with a convincing scam

The onslaught begins with societal engineering. Criminals telephone oregon connection victims portion posing arsenic slope employees, authorities representatives oregon enactment agents. They nonstop radical to fake websites that lucifer authoritative services oregon the Google Play Store. However, the app comes from extracurricular Google Play. The unfortunate sideloads an APK, which means installing an Android app from different source. After installation, the app guides the unfortunate done enabling Accessibility.

Android built Accessibility services to assistance radical usage their devices. However, those services tin besides fto an approved app observe the surface and execute actions for the user. RedHook takes vantage of that control. It simulates taps, opens Settings and enables Developer Options. Next, it turns connected Wireless Debugging and asks Android for a pairing code.

The malware reads the codification and connects backmost to the telephone done 127.0.0.1, a section code that points to the aforesaid device. In effect, RedHook tricks the telephone into connecting to its ain almighty debugging controls, giving the malware deeper entree without a computer.

Why Wireless ADB gives RedHook much control

ADB stands for Android Debug Bridge. Developers usage it to negociate a telephone from a bid line, instal trial apps and troubleshoot software. Android introduced Wireless Debugging with Android 11, allowing ADB connections implicit Wi-Fi alternatively of a USB cable. Once RedHook pairs with the phone, it gains shell-level access. That gives the malware much authorization than a mean Android app, allowing it to tally almighty commands and alteration protected settings. However, it inactive does not summation afloat basal control.

RedHook tin past assistance itself further permissions, seizure low-level interaction enactment and debar immoderate confirmation screens that would usually alert the user. The malware besides borrows from Shizuku, a morganatic Android inferior utilized by developers and powerfulness users. Shizuku allows approved apps to usage elevated Android features without rooting a phone. RedHook repurposes parts of that model to transportation retired malicious commands.

What RedHook tin bash aft it takes control

Group-IB counted 53 commands that attackers tin nonstop to the existent RedHook version. Some commands look unfinished, but the moving features springiness criminals extended entree to an infected phone.

• Attackers tin watercourse the surface and seizure screenshots.
• The malware records keystrokes and tin cod screen-lock credentials.
• It tin simulate taps, swipes, drags and agelong presses.
• Contacts, substance messages and installed app lists tin beryllium collected.
• RedHook tin instal caller APKs oregon region apps without the accustomed prompts.
• Fake verification windows and black-screen overlays tin fell its activity.
• The malware tin activate a camera, including during a fake individuality check.
• Remote commands tin lock, unlock, aftermath oregon reboot the phone.

That entree creates respective opportunities for fraud. A transgression could ticker you motion successful to a banking app, seizure a verification codification oregon spot a convincing overlay supra a existent login screen. RedHook whitethorn besides region information bundle oregon instal different malicious app.

RedHook uses respective tricks to enactment connected your phone

Gaining entree helps the attacker lone portion the malware remains active. Therefore, RedHook includes respective persistence methods designed to support Android from shutting it down. It tin play soundless audio truthful the operating strategy treats its process arsenic important. A WakeLock keeps the CPU awake. Meanwhile, 2 abstracted services show each different and restart their spouse erstwhile 1 stops.

RedHook besides sets a five-minute alarm that checks whether its services stay alive. After a reboot, a receiver tin restart the malware and reconnect its privileged helper. It adjacent adjusts its out-of-memory people to trim the accidental that Android volition adjacent it erstwhile representation runs low. These methods marque removal harder. They besides explicate wherefore simply swiping the app distant whitethorn execute precise little.

Red flags to ticker for earlier you pat Allow

One informing motion whitethorn person an guiltless explanation. Several appearing unneurotic should marque you halt and investigate.

• A caller oregon connection pressures you to instal an app immediately.
• The download leafage resembles Google Play, but it opens wrong a web browser.
• An app asks for Accessibility entree without a wide request for it.
• Instructions archer you to pat Build fig 7 times to alteration Developer Options.
• Wireless Debugging appears enabled though you ne'er usage developer tools.
• A achromatic overlay oregon fake system-update surface blocks your view.
• An unfamiliar app keeps reopening oregon resists removal.
• A slope oregon authorities typical asks you to instal an APK from a link.

Do not fto an urgent code marque the determination for you. Legitimate organizations tin springiness you clip to verify a petition done an authoritative telephone fig oregon website.

AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS

A caller mentation of RedHook malware exploits Android's Wireless Debugging feature, allowing attackers to bargain data, power apps and show victims' devices. (Photographer: Angel Garcia/Bloomberg via Getty Images)

Ways to enactment harmless from RedHook Android malware

A fewer checks tin halt this onslaught earlier it reaches the Wireless Debugging stage. Other steps tin assistance bounds the harm if you already installed a suspicious app.

Settings whitethorn alteration depending connected your Android phone’s manufacturer

1) Install apps done Google Play

Avoid APK files sent done texts, messaging apps oregon unexpected telephone calls. Apps downloaded from chartless sources tin enactment your instrumentality and idiosyncratic accusation astatine risk. You should besides reappraisal which apps tin instal bundle from extracurricular Google Play. Open Settings and hunt for Install chartless apps . Turn disconnected this support for browsers, messaging apps and record managers unless you person a circumstantial crushed to usage it.

2) Verify the caller connected your own

Hang up and telephone the enactment utilizing the fig printed connected your slope paper oregon listed connected its authoritative website. Avoid telephone numbers included successful the message, pop-up oregon download page. Be particularly cautious erstwhile idiosyncratic contacts you unexpectedly and pressures you to alteration a telephone mounting oregon instal an app. Google lists some behaviors arsenic informing signs of a imaginable scam.

3) Treat Accessibility requests arsenic highly sensitive

Open Settings and hunt for Accessibility . Then reappraisal Installed apps , Downloaded apps oregon Installed services , depending connected your phone. Turn disconnected entree for thing you bash not recognize. An mean banking, transportation oregon authorities app seldom needs support to work your surface and power your taps. Pause whenever an app claims that Accessibility entree is required to implicit verification. As CyberGuy has antecedently reported, malware tin maltreatment Accessibility permissions to instrumentality power of an Android phone.

4) Keep Google Play Protect enabled and tally a scan

Open the Google Play Store > pat your illustration icon > Play Protect . Tap Scan to cheque the apps presently installed connected your phone. Play Protect whitethorn pass you astir harmful software, which you tin disable oregon region from the phone. Google Play Protect, which is built-in malware extortion for Android devices, automatically removes known malware. However, Play Protect whitethorn not drawback each malicious app, truthful beardown antivirus bundle adds different furniture of protection.

5) Use beardown antivirus software

Strong antivirus bundle tin assistance emblem malicious links, suspicious downloads and harmful apps. Keep its extortion active, particularly if you sometimes person APK files for enactment oregon testing. However, bash not presume an antivirus scan has afloat removed RedHook if the app keeps returning oregon your settings proceed to change. Get my picks for the champion 2026 antivirus extortion winners for your Windows, Mac, Android and iOS devices astatine CyberGuy.com

6) Install Android and Google Play strategy updates

Open Settings > Software updates , past travel the prompts. You tin besides cheque your Android information update and Google Play strategy update nether About telephone > Android mentation . Paths tin disagree somewhat by device.

7) Get assistance if you deliberation your telephone is infected

Turn connected Airplane mode and usage different trusted instrumentality to interaction your slope and alteration important passwords. Do not participate much accusation connected the affected phone. Try to region the suspicious app oregon interaction your telephone manufacturer, bearer oregon a trusted repair nonrecreational for help. A mill reset whitethorn beryllium indispensable if the app returns oregon the telephone continues behaving strangely.

8) Consider removing exposed idiosyncratic information

A information removal work tin assistance trim the idiosyncratic details disposable astir you connected people-search sites. That whitethorn see your location address, telephone fig and accusation astir relatives. However, a information removal work cannot cleanable malware from your phone, retrieve stolen login accusation oregon region information that criminals already copied. You tin besides taxable opt-out requests yourself for free, though the process tin instrumentality time. Information whitethorn aboriginal reappear, truthful continued monitoring whitethorn beryllium needed. Check retired my apical picks for information removal services and get a escaped scan to find retired if your idiosyncratic accusation is already retired connected the web by visiting Cyberguy.com

HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER

Security experts accidental Android users should debar sideloading apps and beryllium cautious of unexpected requests to alteration Accessibility oregon Developer Options. (Photographer: Brent Lewin/Bloomberg via Getty Images)

Kurt's cardinal takeaways

RedHook depends connected societal engineering earlier it tin instrumentality control. The attacker inactive needs you to instal a malicious app and o.k. almighty Accessibility permissions. That gives you a accidental to halt the onslaught early. Be suspicious of urgent calls, fake app pages and anyone who tells you to instal an APK from a link. Google Play Protect and beardown antivirus bundle tin help, but your champion defence is slowing down earlier you o.k. an unexpected request.

Should Android marque Accessibility permissions harder to o.k. erstwhile an app comes from extracurricular Google Play? Let america cognize by penning to america astatine Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

• Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox.
• For simple, real-world ways to spot scams aboriginal and enactment protected, sojourn CyberGuy.com - trusted by millions who ticker CyberGuy connected TV daily.
• Plus, you'll get instant entree to my Ultimate Scam Survival Guide escaped erstwhile you join.

Copyright 2026 CyberGuy.com. All rights reserved.