Overview
- The malware automates user prompts to grant Accessibility permission, enable Developer Options and turn on Wireless Debugging so it can read the on-screen pairing code and connect to the device’s ADB service via 127.0.0.1.
- Once paired the app gains shell-level privileges (UID 2000), a higher privilege set than normal apps that lets it run many system commands without requiring a rooted phone.
- RedHook drops a Shizuku-based component (libmx.so) that acts as a local privileged server to invoke protected Android APIs, silently install or remove apps, change settings, and run up to 53 remote commands the operators can issue.
- The malware uses multiple stealth and persistence tricks such as silent audio to raise process priority, WakeLocks, mutually restarting services, a five-minute watchdog alarm, auto-restart on boot, and a low oom_score_adj value to resist termination.
- Operators spread RedHook through social-engineering lures that impersonate banks or agencies and send victims to fake Google Play sites, so users should install only from trusted stores, review Accessibility requests closely, and keep Play Protect enabled.