Invisible Pixels and Silent Audio: How the New RedHook Malware Hijacks Android Phones

A sophisticated new strain of Android malware is actively hijacking smartphones to steal banking credentials by weaponizing the operating system's own developer tools. Discovered by cybersecurity firm Group-IB, the upgraded RedHook malware grants hackers unprecedented remote control over infected devices.

Unlike traditional threats, RedHook abuses Android’s Wireless Debugging feature - a tool typically reserved for developers - to gain deep system access without requiring a physical computer connection. Attackers initiate the compromise through social engineering, using phone calls and messages to impersonate banks or government agencies.

Currently targeting users in Vietnam and Indonesia, the campaign directs victims to fraudulent websites masquerading as the Google Play Store. From there, users are tricked into downloading malicious applications hosted on legitimate cloud infrastructure, including GitHub and Amazon Web Services.

Once installed, the malware displays deceptive overlays to trick users into granting Accessibility permissions. It then silently activates hidden developer settings in the background, connecting the device to itself to establish high-level control.

RedHook abuses ADB Wireless Debugging to obtain shell-level privileges. With this access, attackers can steal passwords, stream the screen, capture lock screen codes, and create fake dialogs to steal banking information.

- Group-IB

To evade detection and survive removal attempts, RedHook employs advanced persistence techniques. These include running a nearly invisible one-pixel screen activity, playing silent audio tracks, and utilizing interconnected services that automatically restart one another if terminated.

Because RedHook relies on manipulating built-in system tools, users must take proactive steps to secure their devices against this specific attack vector.

• Disable Developer Options: Ensure that Developer Options, specifically Wireless Debugging, are turned off in your system settings unless actively needed for programming.
• Audit Accessibility Permissions: Regularly check which apps have access to Accessibility services and revoke permissions for any unrecognized or suspicious applications.
• Avoid Sideloading: Never download applications from links sent via SMS or third-party websites, even if they visually mimic the official Google Play Store.

The shift from exploiting zero-day vulnerabilities to abusing legitimate OS features like ADB Wireless Debugging represents a dangerous evolution in mobile malware. Because these tools are built into Android by design, traditional antivirus software often struggles to flag their activity as malicious without generating false positives for actual developers.

This upgraded technique makes RedHook significantly harder to detect and remove than typical financial trojans. Google may need to introduce stricter authentication barriers, automatic timeouts, or physical confirmation prompts for Wireless Debugging to prevent this vector from becoming a standard playbook for financial cybercrime.