# RedHook Android RAT Abuses Wireless ADB via Accessibility Service to Gain Shell-Level Device Access

> An upgraded variant of the RedHook Android RAT abuses Accessibility Service permissions to silently enable Developer Options and Wireless Debugging, then connects to the on-device ADB daemon over loopback (127.0.0.1) to obtain shell (uid 2000) privileges without root or USB access, then deploys embedded Shizuku-derived code to execute privileged commands. It supports 53 server-issued commands including screen streaming, keystroke interception, credential theft, and camera activation, and is distributed via social engineering impersonating government and financial institutions.

- **Published:** 2026-07-12T00:00:00Z
- **Last reviewed:** 2026-07-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1248
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-redhook-rat-loopback-adb-shell-tl-2026-1248.webp?v=6f33a199 (Threadlinqs threat intel: RedHook Android RAT Wireless ADB Shell: Detection & IOCs (TL-2026-1248) — High severity, 29 IOCs, 9 detection rules.)
- **ID:** TL-2026-1248
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** RedHook Operators (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

RedHook is an Android remote access trojan first documented by Cyble Research and Intelligence Labs in July 2025 as a banking trojan targeting Vietnamese users, distributed through phishing sites impersonating the State Bank of Vietnam (sbvhn[.]com), Sacombank, Central Power Corporation, the Traffic Police of Vietnam (CSGT), and the Vietnamese government. The original variant abused Accessibility Services and overlay permissions to harvest keystrokes, capture the screen via the MediaProjection API, and exfiltrate SMS, contacts, and banking credentials through a WebSocket-based RAT supporting 34 server-issued commands. APKs were hosted on an exposed AWS S3 bucket and CloudFront distribution; sequential user IDs in the leaked infrastructure suggested over 500 infected devices. Chinese-language strings in logs and leaked screenshots suggest a Chinese-speaking developer or operator.

In July 2026, Group-IB documented a significantly upgraded RedHook variant that is the first malware observed abusing Android's Wireless ADB (Wireless Debugging) feature to autonomously self-escalate privileges. Using its existing Accessibility Service foothold, the malware programmatically simulates the exact UI interactions a user would perform to enable Developer Options, activate Wireless Debugging, and pair itself as an authorized computer -- all invisibly, behind a full-screen overlay or fake system update dialog. It then launches an embedded ADB client (referenced internally as "libmx.so") that connects to the on-device adbd daemon over the loopback interface and spawns a privileged shell process at uid 2000 (the Android `shell` user). This shell-level access is functionally equivalent to what the legitimate open-source Shizuku framework provides to enthusiasts seeking elevated permissions without rooting; RedHook embeds Shizuku-derived logic to run a persistent privileged server that can grant itself additional runtime permissions, write to `Settings.Secure` (including `WRITE_SECURE_SETTINGS`), execute arbitrary shell commands, silently install/uninstall applications, and capture raw touch input -- all without further user prompts. This escalation path requires no root and no USB/OEM unlocking, working on any Android 11+ device that supports Wireless Debugging, which is the overwhelming majority of the current install base.

The command set has grown to 53 server-issued functions covering device reconnaissance, UI automation (taps, swipes, gestures, drags, long presses), notification bar access, contact/app/SMS harvesting, UI-layout (accessibility node tree) exfiltration, silent APK install/uninstall, text injection and navigation control, screen capture (screenshot and continuous streaming via WebSocket and, once privileged, RTMP), camera activation, device reboot, permission-check and grant primitives, fake system-update overlays, ADB-prompt dismissal automation, and OEM-specific routines tuned for Samsung, Xiaomi, Oppo, Vivo, Huawei, Meizu, and Google devices.

Persistence is achieved through a layered stack: a 1x1-pixel foreground activity that keeps the app foreground-classified even with the screen off; silent background audio playback via a MediaSession to win elevated OS process priority; a held WakeLock to defeat battery-optimization suspension; two mutually-monitoring internal services that relaunch each other via BIND_AUTO_CREATE if either is killed; a five-minute watchdog alarm that re-verifies service health; a BOOT_COMPLETED receiver for post-reboot restoration; and an oom_score_adj value of -1000 that exempts the process from Android's low-memory killer.

Distribution continues via social engineering: operators impersonate government officials or bank support staff over phone calls and messaging apps (Zalo is specifically documented), directing victims to fake Google Play Store replica sites to download a malicious APK. Targeting has expanded from Vietnam to Indonesia and the broader Southeast Asia region. C2 infrastructure for the 2026 variant uses the domain 3n7wj[.]com with dedicated API and WebSocket subdomains; the original 2025 campaign used iosgaxx423[.]xyz and jftxm[.]xyz infrastructure alongside AWS S3/CloudFront-hosted payloads.

## MITRE ATT&CK

- T1583.006 Web Services
- T1660 Phishing
- T1204.001 Malicious Link
- T1623 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1624.001 Broadcast Receivers
- T1541 Foreground Persistence
- T1548 Abuse Elevation Control Mechanism
- T1548.004 Elevated Execution with Prompt
- T1564 Hide Artifacts
- T1655 Masquerading
- T1629 Impair Defenses
- T1417 Input Capture
- T1417.002 GUI Input Capture
- T1082 System Information Discovery
- T1418 Software Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1636.004 SMS Messages
- T1636.003 Contact List
- T1125 Video Capture
- T1571 Non-Standard Port
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RedHook Loopback ADB Shell-UID-2000 Spawn Following Accessibility Grant (Shizuku-derived Privileged Server)** (`TL-2026-1248-SPL-002`)

Detects a shell process at uid 2000 spawned from a loopback (127.0.0.1) adbd connection within 60 seconds of an Accessibility Service permission grant, followed by WRITE_SECURE_SETTINGS self-grant or silent package install/uninstall -- the post-exploitation signature of RedHook's Shizuku-derived privileged server (libmx.so).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1548, T1548.004, T1564, T1082
- **Data sources:** android_process_creation, mdm_telemetry, android_accessibility_grant_log
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=mdm sourcetype="android:process_creation" ParentProcess="adbd" ProcessUid=2000 ConnectionSource="127.0.0.1"
| eval spawn_time=_time
| join type=left device_id [ search index=mdm sourcetype="android:accessibility_grant" earliest=-2m@m
    | eval grant_time=_time | fields device_id, grant_time, package_name ]
| where (spawn_time - grant_time) <= 60 AND (spawn_time - grant_time) >= 0
| join type=left device_id [ search index=mdm sourcetype="android:permission_grant" permission="WRITE_SECURE_SETTINGS" grant_actor="self" OR sourcetype="android:pm_ops" (operation="install" OR operation="uninstall") silent=1
    | fields device_id, operation, permission ]
| stats count values(package_name) as accessibility_app values(operation) as pm_operations by device_id, ParentProcess, ProcessUid
| where count > 0
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "adbd"
| where AccountSid == "2000" or ProcessUid == "2000"
| where RemoteIP == "127.0.0.1" or InitiatingProcessRemoteIP == "127.0.0.1"
| join kind=inner (
    AndroidAccessibilityGrantEvents
    | where TimeGenerated > ago(24h)
    | project GrantTime = TimeGenerated, DeviceId, PackageName
) on DeviceId
| where Timestamp between (GrantTime .. (GrantTime + 60s))
| project Timestamp, DeviceId, PackageName, InitiatingProcessFileName, ProcessUid = "2000"
| summarize Count = count() by DeviceId, PackageName
```

### Sigma

```yaml
title: Loopback ADB Shell Spawned Immediately After Accessibility Service Grant
id: 3c7e9b41-8a2d-4f61-9c3e-2b1a4d5e6f70
status: experimental
description: Detects a shell process (uid 2000) spawned from a loopback adbd connection (127.0.0.1) within seconds of an Accessibility Service permission grant, matching RedHook's self-escalation chain via its embedded Shizuku-derived libmx.so client.
references:
    - https://www.group-ib.com/blog/redhook-android-rat-upgraded/
    - https://cybersecuritynews.com/redhook-android-rat-abuses-adb-wireless-debugging/
author: AII-Detector -- ThreadLinqs Intelligence
date: 2026-07-12
tags:
    - attack.privilege-escalation
    - attack.t1548
    - attack.t1548.004
    - attack.defense-evasion
    - attack.t1564
    - attack.tool.shizuku
logsource:
    product: android
    category: process_creation
detection:
    selection:
        ParentProcess: 'adbd'
        ProcessUid: 2000
        ConnectionSource: '127.0.0.1'
    timeframe: 60s
    condition: selection
falsepositives:
    - Legitimate developer use of the open-source Shizuku app, which uses the identical loopback-ADB shell-uid-2000 mechanism intentionally
    - Authorized MDM remote-support tooling that pairs over Wireless ADB with explicit user consent dialogs
level: critical
```

**Known false positives:**

- Legitimate Shizuku app usage by power users intentionally granting shell-level access to their own device
- Authorized remote-support MDM tooling pairing over Wireless ADB with an explicit user-confirmed dialog

**Tuning notes:** Cross-reference the spawning package against the legitimate Shizuku package name (moe.shizuku.privileged.api) and the org's MDM remote-support allowlist to reduce false positives; require the absence of a prior user-facing Wireless-Debugging-pairing confirmation dialog event to distinguish malicious self-pairing from legitimate pairing.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RedHook Fake Government/Bank APK Sideload from Phishing Distribution Chain (locked: unlock with TL Creds)
- RedHook Anti-Kill Persistence Stack: Boot Restoration + Mutual Service Resurrection + OOM-Killer Exemption (locked: unlock with TL Creds)
- RedHook Live Screen Streaming / RTMP Handoff Following Privileged Shell Escalation (locked: unlock with TL Creds)
- RedHook Accessibility-Driven Runtime Permission Self-Grant (WRITE_SECURE_SETTINGS) (locked: unlock with TL Creds)
- RedHook Silent Package Install/Uninstall via Privileged Shell (pm install/uninstall, No PlayStore Session) (locked: unlock with TL Creds)
- RedHook Sensitive Data Exfiltration Chain: SMS, Contacts, Keylog and Screen/Camera Capture to Non-Allowlisted Domain (locked: unlock with TL Creds)
- RedHook Accessibility Service Enables Developer Options / Wireless Debugging (MDM Telemetry) (locked: unlock with TL Creds)
- RedHook C2 Beacon and Structured Exfil POSTs to App-Specific Endpoint Paths (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- Domain: `3n7wj[.]com`
- URL: `hxxps://nfe-bucketapk[.]s3[.]ap-southeast-1[.]amazonaws[.]com/SBV.apk`
- File hash: `453333bffdd1850ea2e0647f7c805530b578919978a01b1e2be52d6eb2add946`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [RedHook Android malware now uses Wireless ADB for shell access](https://www.bleepingcomputer.com/news/security/redhook-android-malware-now-uses-wireless-adb-for-shell-access/)
- [RedHook Returns with a Dangerous Upgrade](https://www.group-ib.com/blog/redhook-android-rat-upgraded/)
- [RedHook Android RAT Abuses ADB Wireless Debugging to Gain Shell-Level Access](https://cybersecuritynews.com/redhook-android-rat-abuses-adb-wireless-debugging/)
- [RedHook Abuses Accessibility Service to Enable Developer Options and Wireless Debugging](https://gbhackers.com/redhook-abuses-accessibility-service-to-enable-developer-options-and-wireless-debugging/)
- [Android RAT RedHook Uses Wireless ADB to Silently Grant Permissions and Control Devices](https://cyberpress.org/redhook-abuses-wireless-adb/)
- [RedHook: A New Android Banking Trojan Targeting Users In Vietnam](https://cyble.com/blog/redhook-new-android-banking-targeting-in-vietnam/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1248