New RedHook Malware Exploits Android Features to Hijack Phones
The sophisticated malware tricks users into granting extensive permissions, enabling attackers to control devices remotely.
A newly identified Android malware strain, dubbed RedHook, is leveraging sophisticated techniques to gain deep control over infected devices, according to cybersecurity researchers. The malware abuses Android's Wireless Debugging feature and Accessibility services to steal sensitive information, monitor user activity, and even install or remove applications without explicit user consent.
The attack chain begins with social engineering, where criminals impersonate trusted entities such as bank employees or government representatives. They then direct victims to malicious websites that mimic legitimate services or the Google Play Store. Users are prompted to download and install an application package (APK) file from an untrusted source, a process known as sideloading.
Once installed, the RedHook malware guides the user through enabling Android's Accessibility services. While designed to assist users with disabilities, these services can be exploited by malicious apps to observe screen activity and perform actions on behalf of the user. RedHook uses this access to simulate taps, navigate settings, and enable Developer Options, ultimately activating Wireless Debugging.
This activation allows RedHook to establish a connection to the device via a local address, granting it shell-level privileges. This level of access surpasses that of typical Android applications, enabling the malware to execute powerful system commands and modify protected settings, although it does not achieve full root control. Researchers note that RedHook borrows from legitimate Android utilities like Shizuku to bypass standard security measures.
With this elevated access, RedHook can perform a wide range of malicious actions. Attackers can stream the device's screen, capture screenshots, record keystrokes, and steal login credentials. The malware can also simulate user interactions, collect contact and message data, and install or uninstall apps. Fake verification windows and black-screen overlays are employed to mask its activity, and it can even activate the device's camera.
To ensure its persistence, RedHook employs several self-protection mechanisms. It can play silent audio to prevent the operating system from terminating its process, utilize WakeLocks to keep the CPU active, and use a system of self-monitoring services to ensure it restarts if stopped. An alarm is set to periodically check if its services are running, and it adjusts its memory management score to avoid being closed by Android when system resources are low.
Security experts advise users to remain vigilant against urgent requests to install applications, especially those originating from outside the official Google Play Store. They recommend verifying caller identities through independent channels, treating Accessibility permission requests with extreme caution, and ensuring that Google Play Protect and reliable antivirus software are enabled. Keeping Android and Google Play system updates current is also crucial for patching potential vulnerabilities.