The RedHook Android banking trojan has just reached a new milestone. In an analysis published in July 2026, researchers describe a new version of the malware capable of hijacking Android's wireless debugging feature, a function reserved for developers, to grant itself system-level privileges. All of this without exploiting any vulnerability or rooting the device.
RedHook's entry point has not changed since its initial discovery in July 2025. The attack begins with a call or a message impersonating a bank or a government body. The victim is directed to a fake site mimicking the Google Play Store, prompting them to install an application. The APK is downloaded outside the official store, often hosted on infrastructures perceived as trustworthy such as GitHub repositories or cloud storage, which makes distribution more reliable.
Once the application is launched, a fake tutorial guides the user into granting the accessibility permission. This authorization gives an application broad control over the device interface. It is the foundation on which the rest of the attack rests.
This is where the new version of the malware stands apart. RedHook relies on accessibility to enable the developer options itself, then wireless debugging (Wireless ADB).
ADB (Android Debug Bridge) is a tool that normally lets a computer control an Android device through a command line, to debug an application or install software. Wireless debugging extends this capability over the network, without a USB cable. In both cases, the intended use assumes a third-party machine acting as host.
The malware bypasses this constraint. It runs directly on the phone the component that normally runs on the computer, and connects to it via the device's internal network address. The device thus becomes its own host, with no PC or cable. RedHook then obtains a privileged shell, a far higher level of access than that of an ordinary application. With these privileges, it can install and uninstall applications, modify protected system settings and grant itself sensitive permissions, all without any confirmation dialog. To achieve this, it reuses the code of an open source framework, originally designed to offer these same capabilities legitimately.
There is no vulnerability exploited here, only a legitimate debugging tool turned into a path to system-level rights.
RedHook combines this access with a particularly robust persistence mechanism. Two of its services work as a pair and relaunch each other, so that stopping one immediately triggers the restart of the other. The malware also maintains an invisible one-pixel activity on the screen and plays silent audio, two mechanisms that push the system to treat it as a high-priority process not to be interrupted. After the phone restarts, it re-enables wireless debugging and restores its privileges within seconds. Uninstalling it then becomes very difficult.
Its capabilities are just as extensive. It streams the victim's screen in real time, logs keystrokes, steals the lock-screen code, intercepts SMS messages and responds to a wide set of remotely controlled commands. One of them notably displays a fake verification window and activates the front-facing camera to capture the user's face.
RedHook is not an isolated case. Applications are the leading attack vector on mobile devices, accounting for 67% of detected threats, with on average 15 malicious applications on a device.
Abusing accessibility as a starting point is a pattern found in many malware families. The Herodotus trojan uses it to take over banking sessions in real time, PromptSpy to deploy a remote control module. Each time, the same permission serves as a springboard.
RedHook takes the logic one step further by using it to reach system-level rights.
Faced with this type of threat, Pradeo Mobile Threat Defense acts on several levels: