RedHook: the banking trojan that grants itself system-level access on Android

The RedHook Android banking trojan has just reached a new milestone. In an analysis published in July 2026, researchers describe a new version of the malware capable of hijacking Android's wireless debugging feature, a function reserved for developers, to grant itself system-level privileges. All of this without exploiting any vulnerability or rooting the device. 

An infection that starts with a trusted message

RedHook's entry point has not changed since its initial discovery in July 2025. The attack begins with a call or a message impersonating a bank or a government body. The victim is directed to a fake site mimicking the Google Play Store, prompting them to install an application. The APK is downloaded outside the official store, often hosted on infrastructures perceived as trustworthy such as GitHub repositories or cloud storage, which makes distribution more reliable.

Once the application is launched, a fake tutorial guides the user into granting the accessibility permission. This authorization gives an application broad control over the device interface. It is the foundation on which the rest of the attack rests.

Wireless debugging turned into system-level access

This is where the new version of the malware stands apart. RedHook relies on accessibility to enable the developer options itself, then wireless debugging (Wireless ADB).

ADB (Android Debug Bridge) is a tool that normally lets a computer control an Android device through a command line, to debug an application or install software. Wireless debugging extends this capability over the network, without a USB cable. In both cases, the intended use assumes a third-party machine acting as host.

The malware bypasses this constraint. It runs directly on the phone the component that normally runs on the computer, and connects to it via the device's internal network address. The device thus becomes its own host, with no PC or cable. RedHook then obtains a privileged shell, a far higher level of access than that of an ordinary application. With these privileges, it can install and uninstall applications, modify protected system settings and grant itself sensitive permissions, all without any confirmation dialog. To achieve this, it reuses the code of an open source framework, originally designed to offer these same capabilities legitimately.

There is no vulnerability exploited here, only a legitimate debugging tool turned into a path to system-level rights.

A malware that is particularly hard to remove

RedHook combines this access with a particularly robust persistence mechanism. Two of its services work as a pair and relaunch each other, so that stopping one immediately triggers the restart of the other. The malware also maintains an invisible one-pixel activity on the screen and plays silent audio, two mechanisms that push the system to treat it as a high-priority process not to be interrupted. After the phone restarts, it re-enables wireless debugging and restores its privileges within seconds. Uninstalling it then becomes very difficult.

Its capabilities are just as extensive. It streams the victim's screen in real time, logs keystrokes, steals the lock-screen code, intercepts SMS messages and responds to a wide set of remotely controlled commands. One of them notably displays a fake verification window and activates the front-facing camera to capture the user's face.

Accessibility, a recurring entry point for banking trojans

RedHook is not an isolated case. Applications are the leading attack vector on mobile devices, accounting for 67% of detected threats, with on average 15 malicious applications on a device.

Abusing accessibility as a starting point is a pattern found in many malware families. The Herodotus trojan uses it to take over banking sessions in real time, PromptSpy to deploy a remote control module. Each time, the same permission serves as a springboard.

RedHook takes the logic one step further by using it to reach system-level rights.

How Pradeo protects against RedHook

Faced with this type of threat, Pradeo Mobile Threat Defense acts on several levels:

• Any application requesting a critical permission such as accessibility is immediately flagged as potentially malicious.
• The solution detects applications installed outside the official stores, precisely RedHook's distribution method.
• The anti-phishing technology blocks fraudulent links sent via SMS, cutting the attack at its entry point.
• The solution monitors risky configurations across the entire fleet. Any abnormal activation of the developer options and wireless debugging is automatically flagged.