RedHook Android Malware Secretly Hijacks Phones

A single deception can result in a complete phone takeover. According to an analysis by security firm Group-IB, the Android malware known as 'RedHook' has been found exploiting the Wireless Debugging feature to allow attackers to gain shell-level privileges for remote device control.

RedHook infiltrates devices by directing users to fake Google Play Store pages impersonating government agencies or banks, then requesting app installation and accessibility permissions. This enables RedHook to monitor screens, log keystrokes, steal login credentials, and install or delete apps without user consent.

Researchers warn that a single permission approval manipulation can lead to sophisticated remote control attacks, advising extreme caution regarding the installation of apps from unknown sources and requests for accessibility permissions.