RedHook Android RAT Abuses ADB Wireless Debugging and Embedded Shizuku Code for Non-Root Shell-Level Access (uid 2000)
RedHook Android RAT Abuses ADB Wireless Debugging and (TL-2026-1146), also tracked as RedHook, is a high-severity malware campaign, first published 2026-07-09. It has no confirmed attribution, affects Google Android OS (Wireless Debugging / Developer Options feature, maps to 22 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-1146
- Threat ID
- TL-2026-1146
- Also known as
- RedHook
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-09
- Last reviewed
- 2026-07-09
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, government administration
- Target regions
- vietnam, indonesia, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in RedHook Android RAT Abuses ADB Wireless Debugging and
Malware and tooling: RedHook, RedHook Android RAT, Embedded ADB client, Shizuku
RedHook is an Android RAT, first documented by Cyble in July 2025 and re-emerged with upgraded capabilities as of July 2026, that uses social engineering (vishing, Zalo messages, fake Google Play sites) to install a malicious APK, then abuses Accessibility Service automation to silently enable Developer Options and Wireless ADB, self-pairs an embedded ADB client over the loopback interface, and launches a privileged server (libmx.so) using code from the open-source Shizuku framework to obtain shell-level access as uid 2000 without rooting the device.
How RedHook Android RAT Abuses ADB Wireless Debugging and works
RedHook is distributed via a multi-stage social-engineering infection chain: operators impersonate government officials or bank support staff over phone calls and the Zalo messaging app, directing victims to fraudulent websites mimicking the Google Play Store. The malicious APK is hosted on GitHub repositories and AWS S3 buckets for delivery resilience. Once installed, RedHook presents phishing UI screens to harvest credentials and personal information, then walks the victim through enabling Accessibility Service under the pretext of unlocking "full features and functionality."
With Accessibility Service granted, RedHook automates the classic seven-tap sequence on the build number to unlock Developer Options, enables Wireless Debugging, and silently extracts the pairing code, all while an overlay screen obscures the process from the victim. It then launches an embedded ADB client that connects to the device's own ADB daemon over the loopback interface (127.0.0.1) and, using code lifted from the legitimate open-source Shizuku project (normally used by Android power users to gain elevated app permissions without rooting), spawns a privileged server process (libmx.so) running as uid 2000 (shell). This grants the malware the ability to grant itself runtime permissions, execute arbitrary shell commands, and silently install or remove other applications without any security prompts or user confirmation.
Once privileged, RedHook can stream the victim's screen over RTMP in parallel with — and bypassing — the Android MediaProjection API and its mandatory consent dialog, in addition to keylogging, screen-lock credential theft, contact/SMS/app-list enumeration, and UI node-tree collection. A command table of roughly 53 numbered operations (e.g., 10001 device info, 10010/10011 APK install/uninstall, 10018/10019 screen capture and layout monitoring, 10023 a fake verification window that triggers the front camera to capture the victim's face, 10028/10029 disable/enable Accessibility, 10050/10051 ADB setup, 10054 autonomous permission grant, 99999 uninstall of the helper library) is issued over a WebSocket command channel and REST API rooted at api.3n7wj[.]com.
Persistence is multi-layered: a near-invisible 1x1-pixel foreground Activity misclassifies the app as a high-priority foreground process to dodge Android's OOM killer; a silent MediaSession audio stream and a foreground-service wake lock keep the process alive; the process writes -1000 to /proc/<pid>/oom_score_adj; two internal services are mutually bound via bindService()/BIND_AUTO_CREATE and resurrect one another if either is killed, verified by a 5-minute alarm; and a BOOT_COMPLETED receiver silently re-enables Wireless ADB and restores shell privileges within seconds of every reboot.
Dormant, brand-specific automation routines for Google, Huawei, Meizu, Oppo, Samsung, Vivo, and Xiaomi devices were identified in the sample but are not yet active, indicating the operators are staging OEM-specific attack paths for future campaigns. The malware originally targeted victims in Vietnam; the July 2026 resurgence shows expansion into Indonesia with broader Southeast Asia targeting indicated. No CVE has been assigned — RedHook abuses legitimate, intended Android developer functionality (Wireless Debugging) rather than exploiting a software vulnerability, so there is no vendor patch; mitigation is behavioral (disable Developer Options/Wireless Debugging outside development use, restrict Accessibility Service grants, vet APK sources).
MITRE ATT&CK techniques used in TL-2026-1146
Collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1125 Video Capture
Defense Evasion
T1036 Masquerading; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1518 Software Discovery
Execution
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Credential Access
T1555 Credentials from Password Stores
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
Reconnaissance
T1598 Phishing for Information
defense-impairment
Affected products and versions in RedHook Android RAT Abuses ADB Wireless Debugging and
- Google — Android OS (Wireless Debugging / Developer Options feature, Accessibility Service API)
Vulnerable versions: Android 11; Android 12; Android 13; Android 14; Android 15
Remediation for RedHook Android RAT Abuses ADB Wireless Debugging and
Immediate actions
- Disable Developer Options and Wireless Debugging on production/end-user Android devices; audit for unexpectedly enabled ADB Wireless Debugging
- Block network traffic to api.3n7wj[.]com, skt.3n7wj[.]com, and sktv.3n7wj[.]com at DNS/proxy/firewall layer
- Force-uninstall APKs matching SHA-256 453333bffdd1850ea2e0647f7c805530b578919978a01b1e2be52d6eb2add946 and any process spawning libmx.so or mx_server
- Revoke Accessibility Service grants for unrecognized or recently sideloaded applications
- Alert users in Vietnam and Indonesia (banking/government customer bases) about vishing calls and Zalo messages impersonating officials or bank support
Workarounds
- No CVE/vendor patch exists — RedHook abuses legitimate Android developer functionality rather than a vulnerability; mitigation is configuration and behavior-based (see immediate/long_term actions)
Longer-term hardening
- Deploy mobile threat defense (MTD) / EDR with behavioral detection for Accessibility Service abuse and anomalous ADB/Wireless Debugging state changes
- Implement digital risk protection to detect brand impersonation (fake Google Play sites, spoofed government/bank domains)
- Enforce Android Enterprise / MDM policies that block installation from unknown sources and restrict Developer Options on managed devices
- Monitor for RTMP and WebSocket egress from mobile endpoints as a screen-streaming indicator that bypasses MediaProjection consent
- Session-monitoring for financial institutions to detect device-takeover patterns consistent with silently-granted shell-level access
Timeline of RedHook Android RAT Abuses ADB Wireless Debugging and
- RedHook Android RAT first documented by Cyble researchers, targeting victims in Vietnam via social-engineering-delivered malicious APKs.
- Researchers document RedHook's use of parallel RTMP screen/video streaming to bypass the Android MediaProjection API and its mandatory consent dialog once shell privileges are obtained.
- Analysts identify dormant, brand-specific automation routines for Google, Huawei, Meizu, Oppo, Samsung, Vivo, and Xiaomi devices in the sample, not yet active but reserved for future OEM-targeted campaigns.
- Targeting expands beyond Vietnam to include victims in Indonesia, with researchers indicating a broader push across Southeast Asia.
- C2 infrastructure identified under the 3n7wj[.]com domain family, comprising a REST API (api.3n7wj[.]com) and two WebSocket endpoints (skt.3n7wj[.]com for commands, sktv.3n7wj[.]com for screen streaming).
- Researchers disclose that RedHook automates enabling Developer Options and Wireless Debugging via Accessibility Service, self-pairs an embedded ADB client over loopback, and integrates code from the open-source Shizuku framework to obtain shell-level access as uid 2000 without rooting the device.
- Analysts publish the full ~53-entry numbered C2 command table issued over the WebSocket/REST channel rooted at api.3n7wj[.]com, including device info collection, silent APK install/uninstall, screen/layout monitoring, Accessibility toggling, ADB setup, and autonomous permission granting.
- Researchers detail the multi-stage social-engineering infection chain: operators impersonate government officials or bank support staff via phone calls and Zalo messages, directing victims to fraudulent websites mimicking the Google Play Store to install the malicious APK, which is hosted on GitHub repositories and AWS S3 buckets for delivery resilience.
- Cyber Security News and Group-IB report RedHook has resurfaced with upgraded capabilities, including a novel ADB Wireless Debugging abuse technique.
Sources cited for RedHook Android RAT Abuses ADB Wireless Debugging and
Threats related to RedHook Android RAT Abuses ADB Wireless Debugging and
Detection coverage for TL-2026-1146
As of 2026-07-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1146 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.