RedHook Android malware exploits Wireless Debugging to silently capture screens

Security firm Group-IB published an analysis on July 9 revealing a new variant of the Android trojan RedHook that gains shell-level privileges without rooting, exploiting or connecting to a PC. The malware spreads through phishing calls or messages impersonating banks or government agencies, directing victims to sideload an APK from a fake Play Store site. Once installed, it manipulates the device's Accessibility Service to silently enable Developer Options and Wireless Debugging, then connects to the phone's own ADB daemon over loopback to escalate privileges. From this position, it can stream the victim's screen via RTMP, bypassing Android's mandatory MediaProjection consent dialog entirely, while also executing 53 server-issued commands including silent app installs and keystroke logging. Active campaigns have been observed targeting users in Vietnam and Indonesia, though the technique is not geographically limited.