RedHook Android Trojan Automatically Enables Wireless ADB Debugging to Hijack Devices Without Root or User Interaction
The RedHook trojan, first described in July 2025, has received an unprecedented update that lets it independently enable wireless ADB debugging on compromised Android smartphones, achieving system-shell privileges without root or any action from the victim.
According to researchers at Group-IB, the infection follows a familiar social-engineering pattern. Attackers contact targets by phone or messenger, posing as bank or government representatives, and persuade them to download an application from a fake website styled to resemble an official app store. The malicious APK files themselves are hosted on legitimate infrastructure—GitHub repositories and Amazon S3 cloud storage—reducing the likelihood of detection by security solutions.
After installation, victims are convinced to grant the app accessibility-service permissions under the pretext of enabling full functionality. This single permission serves as the gateway to everything else. With accessibility access, RedHook automatically opens the device settings, taps the build number seven times to reveal the developer menu, and activates wireless debugging—all hidden behind a full-screen overlay.
The malware then runs its own ADB client, which connects directly to the phone’s local debugging server using the loopback address, eliminating any need for an external computer. The technique is built on code from the popular Shizuku framework that advanced users normally employ to extend app capabilities without root.
Once system-level privileges are obtained, RedHook can silently install or remove applications, alter protected settings, and grant itself additional permissions without triggering confirmation dialogs. To remain active as long as possible, the trojan employs several anti-termination tactics: it simulates an active foreground window, plays silent audio, prevents the CPU from sleeping, and blocks the system from killing its process under low-memory conditions.
Two service processes monitor each other and restart their counterpart if either is stopped. After a device reboot, a dedicated component automatically restores all privileges. Stolen data and live screen recordings are transmitted over encrypted connections to attacker-controlled servers; when system rights are already present, the malware can stream the screen without triggering the standard screen-recording permission prompt.
Observed campaigns remain focused on Southeast Asia, with infections confirmed in Vietnam and later in Indonesia. Experts advise installing applications exclusively from official stores, scrutinizing permission requests—especially accessibility access—and remaining wary of unsolicited contacts claiming to represent banks or government agencies.
Related articles
Automating Malware Reverse Engineering with Local LLMs, PyGhidra and Neo4j Graphs
A researcher has developed an automated pipeline that uses local large language models to analyze decompiled malware code extracted via PyGhidra. The system loads functions, call graphs, strings and imports into a Neo4j graph database to preserve context across hundreds of functions. Each function is sent to a local Qwen3 model running in LM Studio together with its neighboring call-graph context, producing structured JSON output on purpose, IOCs, tags and evasion techniques. Aggregated capabilities and behavioral patterns such as file encryption and C2 communication are then derived through graph queries. Testing on a WannaCry sample from MalwareBazaar processed 195 functions in 126 minutes and correctly identified File Encryption, C2 Communication and Anti-Analysis behaviors with 100 percent confidence. The approach keeps all sensitive indicators inside a local environment and avoids context overflow and censorship issues common with cloud-based models.
GitHub Removes 10,000 Malware Repositories After Public Exposure but Takes No Further Action
An investigation reveals that GitHub hosts thousands of repositories distributing trojanized ZIP archives, many of which have persisted for two years despite the platform's resources. The malicious repositories follow consistent patterns in README files, including specific headings and links to versioned archives hosted on githubusercontent.com. A detailed article and accompanying script published on Hacker News identified over 10,000 such repositories, prompting GitHub to delete only those specific entries. New repositories matching the same patterns continue to appear and remain active, with no additional proactive measures taken by the security team. The situation highlights questions about Microsoft's approach to automated detection and response on its subsidiary platform.
Dolphin X Malware Adds AI Profiler to Rank and Prioritize High-Value Victims After Infection
Dolphin X is a newly identified Windows infostealer and remote access trojan that integrates an AI Profiler component designed to score infected machines and generate priority rankings for operators. The profiler analyzes telemetry from compromised systems, including application usage, browser domains visited, and installed software, to produce daily summaries that help attackers focus resources on the most valuable targets such as those with cloud access or sensitive tools. Dolphin X claims compatibility with over 300 applications, explicitly covering nine Chromium and Gecko browser families, more than 100 cryptocurrency wallet extensions, 65 desktop wallets, 10 password managers, and over 30 common cloud CLI tools. The malware targets files like .env configurations, SSH keys, cloud access tokens, browser sessions, and cryptocurrency wallet data to accelerate movement from initial credential theft to further compromises in accounts and production environments. Researchers have confirmed the AI Profiler workflow and associated scoring functions in the operator panel, although the underlying AI model itself remains unverified without full analysis of an active sample. The discovery highlights how automated prioritization can significantly shorten the time between mass infections and targeted follow-on attacks, prompting recommendations for reduced local credential storage and enhanced behavioral detection.
YARA Style Guide: Comprehensive Best Practices for Naming, Structuring and Maintaining Detection Rules
The article presents a detailed translation and adaptation of Florian Roth's YARA Style Guide, aimed at bringing consistency to large collections of YARA rules used by security teams. It explains how to construct informative rule names that include threat category, context, operating system, architecture, technology, packers and creation date, using prefixes such as MAL, HKTL, WEBSHELL, EXPL, VULN, SUSP and PUA. The guide recommends specific metadata fields including description, author, date, reference, score and hash, along with a three-tier string categorization system using $x*, $s* and $a* prefixes for high-specificity, group and preliminary strings. It also covers false-positive filters marked with $fp*, proper indentation, readable hex and string formatting, and a recommended order of conditions that begins with header checks and ends with false-positive filters. The publication highlights the benefits of this structured approach for long-term maintainability and faster triage during mass detections. Additional references point to the separate YARA-Performance-Guidelines project for deeper optimization techniques.