RedHook Android Malware (Wireless ADB Shell Abuse Variant)
First seen Jul 13, 2026 · Updated Jul 13, 2026
A new variant of the RedHook Android malware exploits the Android Wireless Debugging (Wireless ADB) feature to obtain shell-level access on infected devices without requiring a wired connection to a computer. This removes a key barrier that previously limited ADB-based attacks, making device compromise more autonomous and scalable. The technique poses a significant risk to Android users and enterprises relying on mobile devices for authentication and access.
Technical Analysis
RedHook abuses Android's Wireless Debugging (Wireless ADB) mechanism, typically used by developers for over-the-air debugging, to establish a shell session on the victim device without a USB/computer tether. This grants the malware elevated command execution capabilities, enabling data exfiltration, app manipulation, and persistence at a privilege level beyond standard app sandboxing. Because Wireless ADB requires pairing/authorization, the malware likely leverages social engineering, accessibility service abuse, or pre-existing device compromise to enable or authorize debugging without user awareness. No CVE has been assigned, as this is an abuse of an intended OS feature rather than a software vulnerability. For organizations using Android devices to run AI agent applications, mobile RAG clients, or as authentication/2FA endpoints for agent orchestration platforms, a compromised device with shell access could allow attackers to intercept API keys, session tokens, or agent credentials stored or displayed on the device, extending the impact beyond the mobile endpoint itself.
Affected Systems
Android devices with Wireless Debugging (Wireless ADB) enabled or enabled via malware-driven social engineering; Android versions supporting Wireless ADB (Android 11+)
Indicators of Compromise
- No specific hashes, IPs, or domains provided in source reporting
Remediation Steps
- 1
Disable Wireless Debugging
Ensure Wireless ADB / Wireless Debugging is disabled in Developer Options unless actively required, and disable Developer Options entirely for non-technical users.
- 2
Restrict app installation sources
Only install apps from Google Play or verified sources; enable Google Play Protect scanning.
- 3
Monitor for anomalous ADB connections
Enterprise MDM solutions should monitor and alert on unauthorized ADB pairing or debugging session activity.
- 4
Apply mobile threat defense (MTD) solutions
Deploy MTD tooling capable of detecting RedHook and similar malware families exhibiting shell-access behavior.
- 5
Review accessibility service permissions
Audit apps with accessibility service permissions, as these are commonly abused to enable debugging features covertly.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.