RedHook Android RAT Abuses ADB Wireless Debugging and Embedded Shizuku Code for Non-Root Shell-Level Access (uid 2000) — Threadlinqs Intelligence
As of 2026-07-09, RedHook Android RAT Abuses ADB Wireless Debugging and Embedded Shizuku Code for Non-Root Shell-Level Access (uid 2000) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1146 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
RedHook is an Android RAT, first documented by Cyble in July 2025 and re-emerged with upgraded capabilities as of July 2026, that uses social engineering (vishing, Zalo messages, fake Google Play
RedHook is distributed via a multi-stage social-engineering infection chain: operators impersonate government officials or bank support staff over phone calls and the Zalo messaging app, directing victims to fraudulent websites mimicking the Google Play Store. The malicious APK is hosted on GitHub repositories and AWS S3 buckets for delivery resilience. Once installed, RedHook presents phishing UI screens to harvest credentials and personal information, then walks the victim through enabling Accessibility Service under the pretext of unlocking "full features and functionality."
With Accessibility Service granted, RedHook automates the classic seven-tap sequence on the build number to unlock Developer Options, enables Wireless Debugging, and silently extracts the pairing code, all while an overlay screen obscures the process from the victim. It then launches an embedded ADB client that connects to the device's own ADB daemon over the loopback interface (127.0.0.1) and, using code lifted from the legitimate open-source Shizuku project (normally used by Android power users to gain elevated app permissions without rooting), spawns a privileged server process (libmx.so) running as uid 2000 (shell). This grants the malware the ability to grant itself runtime permissions, execute arbitrary shell commands, and silently install or remove other applications without any security prompts or user confirmation.
Once privileged, RedHook can stream the victim's screen over RTMP in parallel with — and bypassing — the Android MediaProjection API and its mandatory consent dialog, in addition to keylogging, screen-lock credential theft, contact/SMS/app-list enumeration, and UI node-tree collection. A command table of roughly 53 numbered operations (e.g., 10001 device info, 10010/10011 APK install/uninstall, 10018/10019 screen capture and layout monitoring, 10023 a fake verification window that triggers the front camera to capture the victim's face, 10028/10029 disable/enable Accessibility, 10050/10051 ADB setup, 10054 autonomous permission grant, 99999 uninstall of the helper library) is issued over a WebSocket command channel and REST API rooted at api.3n7wj[.]com.
Persistence is multi-layered: a near-invisible 1x1-pixel foreground Activity misclassifies the app as a high-priority foreground process to dodge Android's OOM killer; a silent MediaSession audio stream and a foreground-service wake lock keep the process alive; the process writes -1000 to /proc/<pid>/oom_score_adj; two internal services are mutually bound via bindService()/BIND_AUTO_CREATE and resurrect one another if either is killed, verified by a 5-minute alarm; and a BOOT_COMPLETED receiver silently re-enables Wireless ADB and restores shell privileges within seconds of every reboot.
Dormant, brand-specific automation routines for Google, Huawei, Meizu, Oppo, Samsung, Vivo, and Xiaomi devices were identified in the sample but are not yet active, indicating the operators are staging OEM-specific attack paths for future campaigns. The malware originally targeted victims in Vietnam; the July 2026 resurgence shows expansion into Indonesia with broader Southeast Asia targeting indicated. No CVE has been assigned — RedHook abuses legitimate, intended Android developer functionality (Wireless Debugging) rather than exploiting a software vulnerability, so there is no vendor patch; mitigation is behavioral (disable Developer Options/Wireless Debugging outside development use, restrict Accessibility Service grants, vet APK sources).
Target sectors: finance, government administration
Target regions: vietnam, indonesia, Southeast Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1598, T1583, T1583, T1608, T1566, T1204, T1548, T1547, T1053, T1564