RedHook Android malware can quietly hijack your phone

Your telephone rings, and nan caller sounds official. They opportunity your slope relationship aliases authorities work needs contiguous verification. A nexus arrives moments later. The page looks for illustration Google Play, and nan caller tells you to instal an app to hole nan problem. Then nan app asks you to move connected Accessibility access, a powerful Android support that tin fto an app publication nan surface and power taps.

That support tin springiness nan latest RedHook Android malware acold much power than a regular app should have. Researchers astatine Group—IB, a world cybersecurity institution that investigates online fraud and integer crime, analyzed nan caller threat. They opportunity nan upgraded distant entree trojan, a type of malware that lets criminals power a instrumentality remotely, abuses Android's Wireless Debugging characteristic to summation shell-level privileges. That intends it tin tally powerful strategy commands and alteration protected settings that mean apps cannot access, though it does not summation afloat guidelines control.

RedHook tin past watch nan screen, grounds what you type, run apps and bargain login information. The caller method besides helps it instal aliases region apps without showing nan accustomed support prompts. That makes 1 rushed support determination particularly costly.

Free unrecorded CyberGuy class: Sick of Spam? Join america July 22

Join america Wednesday, July 22, astatine 1 p.m. ET for a free CyberGuy Live people that will thief you trim down connected robocalls, spam texts, junk email and different unwanted messages. Kurt "CyberGuy" Knutsson will locomotion you measurement by measurement done elemental ways to select spam, cleanable up your inbox and admit nan messages that could put your individual accusation astatine risk. No method acquisition is needed. You’ll besides person our spam-stopping checklist, and each registrant will get a nexus to nan people signaling afterward.

Reserve your free spot coming astatine CyberGuyLive.com.

NEW BANK SCAM LAWS COULD STOP SUSPICIOUS PAYMENTS

Cybersecurity researchers pass that RedHook Android malware tin prehend extended power of a telephone aft users instal a malicious app and alteration Accessibility permissions. (Photographer: Chris Goodney/Bloomberg via Getty Images)

RedHook Android malware starts pinch a convincing scam

The onslaught originates pinch societal engineering. Criminals telephone aliases connection victims while posing arsenic slope employees, authorities representatives aliases support agents. They nonstop group to clone websites that lucifer charismatic services aliases nan Google Play Store. However, nan app comes from extracurricular Google Play. The unfortunate sideloads an APK, which intends installing an Android app from different source. After installation, nan app guides nan unfortunate done enabling Accessibility.

Android built Accessibility services to thief group usage their devices. However, those services tin besides fto an approved app observe nan surface and execute actions for nan user. RedHook takes advantage of that control. It simulates taps, opens Settings and enables Developer Options. Next, it turns connected Wireless Debugging and asks Android for a pairing code.

The malware sounds nan codification and connects backmost to nan telephone done 127.0.0.1, a section reside that points to nan aforesaid device. In effect, RedHook tricks nan telephone into connecting to its ain powerful debugging controls, giving nan malware deeper entree without a computer.

Why Wireless ADB gives RedHook much control

ADB stands for Android Debug Bridge. Developers usage it to negociate a telephone from a bid line, instal trial apps and troubleshoot software. Android introduced Wireless Debugging pinch Android 11, allowing ADB connections over Wi-Fi alternatively of a USB cable. Once RedHook pairs pinch nan phone, it gains shell-level access. That gives nan malware much authority than a normal Android app, allowing it to tally powerful commands and alteration protected settings. However, it still does not summation afloat guidelines control.

RedHook tin past assistance itself further permissions, seizure low-level touch activity and debar immoderate confirmation screens that would usually alert nan user. The malware besides borrows from Shizuku, a morganatic Android inferior utilized by developers and powerfulness users. Shizuku allows approved apps to usage elevated Android features without rooting a phone. RedHook repurposes parts of that model to transportation retired malicious commands.

What RedHook tin do aft it takes control

Group-IB counted 53 commands that attackers tin nonstop to nan existent RedHook version. Some commands look unfinished, but nan moving features springiness criminals extended entree to an infected phone.

• Attackers tin watercourse nan surface and seizure screenshots.
• The malware records keystrokes and tin cod screen-lock credentials.
• It tin simulate taps, swipes, drags and agelong presses.
• Contacts, matter messages and installed app lists tin beryllium collected.
• RedHook tin instal caller APKs aliases region apps without nan accustomed prompts.
• Fake verification windows and black-screen overlays tin hide its activity.
• The malware tin activate a camera, including during a clone personality check.
• Remote commands tin lock, unlock, aftermath aliases reboot nan phone.

That entree creates respective opportunities for fraud. A criminal could watch you motion successful to a banking app, seizure a verification codification aliases spot a convincing overlay supra a existent login screen. RedHook whitethorn besides region information package aliases instal different malicious app.

RedHook uses respective tricks to enactment connected your phone

Gaining entree helps nan attacker only while nan malware remains active. Therefore, RedHook includes respective persistence methods designed to support Android from shutting it down. It tin play silent audio truthful nan operating strategy treats its process arsenic important. A WakeLock keeps nan CPU awake. Meanwhile, 2 abstracted services show each different and restart their partner erstwhile 1 stops.

RedHook besides sets a five-minute siren that checks whether its services stay alive. After a reboot, a receiver tin restart nan malware and reconnect its privileged helper. It moreover adjusts its out-of-memory people to trim nan chance that Android will adjacent it erstwhile representation runs low. These methods make removal harder. They besides explicate why simply swiping nan app distant whitethorn execute very little.

Red flags to watch for earlier you pat Allow

One informing motion whitethorn person an guiltless explanation. Several appearing together should make you extremity and investigate.

• A caller aliases connection pressures you to instal an app immediately.
• The download page resembles Google Play, but it opens wrong a web browser.
• An app asks for Accessibility entree without a clear request for it.
• Instructions show you to pat Build number 7 times to alteration Developer Options.
• Wireless Debugging appears enabled though you ne'er usage developer tools.
• A achromatic overlay aliases clone system-update surface blocks your view.
• An unfamiliar app keeps reopening aliases resists removal.
• A slope aliases authorities typical asks you to instal an APK from a link.

Do not fto an urgent reside make nan determination for you. Legitimate organizations tin springiness you clip to verify a petition done an charismatic telephone number aliases website.

AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS

A caller type of RedHook malware exploits Android's Wireless Debugging feature, allowing attackers to bargain data, power apps and show victims' devices. (Photographer: Angel Garcia/Bloomberg via Getty Images)

Ways to enactment safe from RedHook Android malware

A fewer checks tin extremity this onslaught earlier it reaches nan Wireless Debugging stage. Other steps tin thief limit nan harm if you already installed a suspicious app.

Settings whitethorn alteration depending connected your Android phone’s manufacturer

1) Install apps done Google Play

Avoid APK files sent done texts, messaging apps aliases unexpected telephone calls. Apps downloaded from chartless sources tin put your instrumentality and individual accusation astatine risk. You should besides reappraisal which apps tin instal package from extracurricular Google Play. Open Settings and hunt for Install chartless apps . Turn disconnected this support for browsers, messaging apps and record managers unless you person a circumstantial logic to usage it.

2) Verify nan caller connected your own

Hang up and telephone nan statement utilizing nan number printed connected your slope card aliases listed connected its charismatic website. Avoid telephone numbers included successful nan message, pop-up aliases download page. Be particularly cautious erstwhile personification contacts you unexpectedly and pressures you to alteration a telephone mounting aliases instal an app. Google lists some behaviors arsenic informing signs of a imaginable scam.

3) Treat Accessibility requests arsenic highly sensitive

Open Settings and hunt for Accessibility . Then reappraisal Installed apps , Downloaded apps aliases Installed services , depending connected your phone. Turn disconnected entree for thing you do not recognize. An mean banking, transportation aliases authorities app seldom needs support to publication your surface and power your taps. Pause whenever an app claims that Accessibility entree is required to complete verification. As CyberGuy has antecedently reported, malware tin maltreatment Accessibility permissions to take power of an Android phone.

4) Keep Google Play Protect enabled and tally a scan

Open nan Google Play Store > pat your floor plan icon > Play Protect . Tap Scan to cheque nan apps presently installed connected your phone. Play Protect whitethorn pass you astir harmful software, which you tin disable aliases region from nan phone. Google Play Protect, which is built-in malware protection for Android devices, automatically removes known malware. However, Play Protect whitethorn not drawback each malicious app, truthful strong antivirus software adds different furniture of protection.

5) Use beardown antivirus software

Strong antivirus package tin thief emblem malicious links, suspicious downloads and harmful apps. Keep its protection active, particularly if you sometimes person APK files for activity aliases testing. However, do not presume an antivirus scan has afloat removed RedHook if nan app keeps returning aliases your settings proceed to change. Get my picks for nan champion 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices astatine CyberGuy.com

6) Install Android and Google Play strategy updates

Open Settings > Software updates , past travel nan prompts. You tin besides cheque your Android information update and Google Play strategy update nether About telephone > Android type . Paths tin disagree somewhat by device.

7) Get thief if you deliberation your telephone is infected

Turn connected Airplane mode and usage different trusted instrumentality to interaction your slope and alteration important passwords. Do not participate much accusation connected nan affected phone. Try to region nan suspicious app aliases interaction your telephone manufacturer, bearer aliases a trusted repair master for help. A mill reset whitethorn beryllium basal if nan app returns aliases nan telephone continues behaving strangely.

8) Consider removing exposed individual information

A information removal work tin thief trim nan individual specifications disposable astir you connected people-search sites. That whitethorn see your location address, telephone number and accusation astir relatives. However, a information removal work cannot cleanable malware from your phone, retrieve stolen login accusation aliases region information that criminals already copied. You tin besides taxable opt-out requests yourself for free, though nan process tin return time. Information whitethorn later reappear, truthful continued monitoring whitethorn beryllium needed. Check retired my apical picks for information removal services and get a free scan to find retired if your individual accusation is already retired connected nan web by visiting Cyberguy.com

HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER

Security experts opportunity Android users should debar sideloading apps and beryllium cautious of unexpected requests to alteration Accessibility aliases Developer Options. (Photographer: Brent Lewin/Bloomberg via Getty Images)

Kurt's cardinal takeaways

RedHook depends connected societal engineering earlier it tin return control. The attacker still needs you to instal a malicious app and o.k. powerful Accessibility permissions. That gives you a chance to extremity nan onslaught early. Be suspicious of urgent calls, clone app pages and anyone who tells you to instal an APK from a link. Google Play Protect and beardown antivirus package tin help, but your champion defense is slowing down earlier you o.k. an unexpected request.

Should Android make Accessibility permissions harder to o.k. erstwhile an app comes from extracurricular Google Play? Let america cognize by penning to america astatine Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

• Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox.
• For simple, real-world ways to spot scams early and enactment protected, sojourn CyberGuy.com - trusted by millions who watch CyberGuy connected TV daily.
• Plus, you'll get instant entree to my Ultimate Scam Survival Guide free erstwhile you join.

Copyright 2026 CyberGuy.com. All authorities reserved.