# RedHook Android RAT Abuses ADB Wireless Debugging and Embedded Shizuku Code for Non-Root Shell-Level Access (uid 2000)

> RedHook is an Android RAT, first documented by Cyble in July 2025 and re-emerged with upgraded capabilities as of July 2026, that uses social engineering (vishing, Zalo messages, fake Google Play sites) to install a malicious APK, then abuses Accessibility Service automation to silently enable Developer Options and Wireless ADB, self-pairs an embedded ADB client over the loopback interface, and launches a privileged server (libmx.so) using code from the open-source Shizuku framework to obtain shell-level access as uid 2000 without rooting the device.

- **Published:** 2026-07-09T00:00:00Z
- **Last reviewed:** 2026-07-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1146
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-redhook-shizuku-adb-shell-rat-tl-2026-1146.webp?v=e836572f (Threadlinqs threat intel: RedHook Android RAT Shizuku Abuse: Detection & IOCs (TL-2026-1146) — High severity, 23 IOCs, 9 detection rules.)
- **ID:** TL-2026-1146
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (2 shown free below)

## Description

RedHook is distributed via a multi-stage social-engineering infection chain: operators impersonate government officials or bank support staff over phone calls and the Zalo messaging app, directing victims to fraudulent websites mimicking the Google Play Store. The malicious APK is hosted on GitHub repositories and AWS S3 buckets for delivery resilience. Once installed, RedHook presents phishing UI screens to harvest credentials and personal information, then walks the victim through enabling Accessibility Service under the pretext of unlocking "full features and functionality."

With Accessibility Service granted, RedHook automates the classic seven-tap sequence on the build number to unlock Developer Options, enables Wireless Debugging, and silently extracts the pairing code, all while an overlay screen obscures the process from the victim. It then launches an embedded ADB client that connects to the device's own ADB daemon over the loopback interface (127.0.0.1) and, using code lifted from the legitimate open-source Shizuku project (normally used by Android power users to gain elevated app permissions without rooting), spawns a privileged server process (libmx.so) running as uid 2000 (shell). This grants the malware the ability to grant itself runtime permissions, execute arbitrary shell commands, and silently install or remove other applications without any security prompts or user confirmation.

Once privileged, RedHook can stream the victim's screen over RTMP in parallel with — and bypassing — the Android MediaProjection API and its mandatory consent dialog, in addition to keylogging, screen-lock credential theft, contact/SMS/app-list enumeration, and UI node-tree collection. A command table of roughly 53 numbered operations (e.g., 10001 device info, 10010/10011 APK install/uninstall, 10018/10019 screen capture and layout monitoring, 10023 a fake verification window that triggers the front camera to capture the victim's face, 10028/10029 disable/enable Accessibility, 10050/10051 ADB setup, 10054 autonomous permission grant, 99999 uninstall of the helper library) is issued over a WebSocket command channel and REST API rooted at api.3n7wj[.]com.

Persistence is multi-layered: a near-invisible 1x1-pixel foreground Activity misclassifies the app as a high-priority foreground process to dodge Android's OOM killer; a silent MediaSession audio stream and a foreground-service wake lock keep the process alive; the process writes -1000 to /proc/<pid>/oom_score_adj; two internal services are mutually bound via bindService()/BIND_AUTO_CREATE and resurrect one another if either is killed, verified by a 5-minute alarm; and a BOOT_COMPLETED receiver silently re-enables Wireless ADB and restores shell privileges within seconds of every reboot.

Dormant, brand-specific automation routines for Google, Huawei, Meizu, Oppo, Samsung, Vivo, and Xiaomi devices were identified in the sample but are not yet active, indicating the operators are staging OEM-specific attack paths for future campaigns. The malware originally targeted victims in Vietnam; the July 2026 resurgence shows expansion into Indonesia with broader Southeast Asia targeting indicated. No CVE has been assigned — RedHook abuses legitimate, intended Android developer functionality (Wireless Debugging) rather than exploiting a software vulnerability, so there is no vendor patch; mitigation is behavioral (disable Developer Options/Wireless Debugging outside development use, restrict Accessibility Service grants, vet APK sources).

## MITRE ATT&CK

- T1598 Phishing for Information
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1548 Abuse Elevation Control Mechanism
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1564 Hide Artifacts
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1518 Software Discovery
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1113 Screen Capture
- T1125 Video Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RedHook C2 Beacon and RTMP-Bypass Screen-Streaming to 3n7wj.com Domain Family** (`TL-2026-1146-SPL-003`)

Detects the C2/lateral-movement stage where an infected device beacons its WebSocket/REST command channel and RTMP-style screen-streaming traffic to the api./skt./sktv.3n7wj.com domain family, bypassing the MediaProjection consent dialog while exfiltrating device info, keystrokes, passwords, and messages.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071, T1573, T1105, T1041, T1113, T1125
- **Data sources:** network_dns, proxy_logs, firewall_logs, mobile_network_connection
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype="dns" query{}.endswith=".3n7wj.com*"
| append [ search index=network sourcetype="proxy" OR sourcetype="firewall" dest_host{}.endswith=".3n7wj.com*" ]
| eval c2_role=case(match(query,"^api\."), "REST_C2", match(query,"^skt\."), "WS_COMMAND", match(query,"^sktv\."), "RTMP_STREAM", true(), "unknown")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, query, c2_role
| table first_seen, last_seen, src_ip, query, c2_role
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "3n7wj.com" or RemoteUrl has_any ("api.3n7wj.com", "skt.3n7wj.com", "sktv.3n7wj.com")
| extend C2Role = case(RemoteUrl has "api.3n7wj.com", "REST_C2", RemoteUrl has "skt.3n7wj.com", "WS_COMMAND", RemoteUrl has "sktv.3n7wj.com", "RTMP_STREAM", "unknown")
| project Timestamp, DeviceId, DeviceName, RemoteUrl, RemoteIP, C2Role
| summarize count(), min(Timestamp), max(Timestamp) by DeviceId, RemoteUrl, C2Role
```

### Sigma

```yaml
title: RedHook C2 Command-Table Beacon over WebSocket/REST to 3n7wj.com Domain Family
id: 9e3c4032-3c4d-4e5f-b06b-c32d4e5f6071
status: experimental
description: Detects DNS/network traffic to the api./skt./sktv.3n7wj.com C2 domain family used by RedHook for command delivery and RTMP-bypass screen streaming.
references:
  - https://www.group-ib.com/blog/redhook-android-rat-upgraded/
  - https://cybersecuritynews.com/redhook-android-rat-abuses-adb-wireless-debugging/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-09
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1573
  - attack.t1105
  - attack.exfiltration
  - attack.t1041
  - attack.tool.redhook
logsource:
  category: dns_query
detection:
  selection:
    query|endswith: '.3n7wj.com'
  condition: selection
falsepositives:
  - None known; 3n7wj.com is a dedicated malicious C2 domain family with no legitimate business use
level: critical
```

**Known false positives:**

- None known — 3n7wj.com has no legitimate business use; monitor for DNS-sinkhole or security-vendor scanning traffic which can be excluded by known scanner ASN allow-list

**Tuning notes:** Add the full IOC set (api./skt./sktv.3n7wj.com) to DNS/proxy blocklists in addition to alerting; correlate RTMP_STREAM role hits with absence of a corresponding MediaProjection consent-dialog event to confirm the bypass.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RedHook Phishing-Delivered APK Sideload from GitHub/S3 Fake Play Store Sites (locked: unlock with TL Creds)
- RedHook BOOT_COMPLETED Wireless-ADB Re-Enable and Mutual Service Resurrection Persistence (locked: unlock with TL Creds)
- RedHook Autonomous Permission Grant and Silent App Install/Uninstall via C2 Command Table (locked: unlock with TL Creds)
- RedHook Fake Verification Window Triggering Front-Camera Facial Capture (Command 10023) (locked: unlock with TL Creds)
- RedHook Invisible 1x1-Pixel Foreground Activity with MediaSession Wake-Lock Abuse (locked: unlock with TL Creds)
- RedHook WebSocket Numbered Command Payload Preceding Unconsented Device-State Change (locked: unlock with TL Creds)
- RedHook Accessibility-Driven Wireless ADB / Developer Options Enablement (locked: unlock with TL Creds)
- RedHook Shizuku-Style Loopback ADB Self-Pairing to uid 2000 Shell (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 23)

Defanged, TLP:CLEAR.

- Domain: `3n7wj[.]com`
- File hash: `453333bffdd1850ea2e0647f7c805530b578919978a01b1e2be52d6eb2add946`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [RedHook Android RAT Abuses ADB Wireless Debugging](https://cybersecuritynews.com/redhook-android-rat-abuses-adb-wireless-debugging/)
- [RedHook Returns with a Dangerous Upgrade](https://www.group-ib.com/blog/redhook-android-rat-upgraded/)
- [Android RAT RedHook Uses Wireless ADB to Silently Grant Permissions and Control Devices](https://cyberpress.org/redhook-abuses-wireless-adb/)
- [Shizuku User Manual](https://shizuku.rikka.app/guide/setup/)
- [Automatically activate Shizuku in Android 14+ (non-root)](https://github.com/RikkaApps/Shizuku/discussions/462)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1146