A sophisticated Android malware called RedHook has been upgraded with a new technique that gives attackers full shell control over your phone — without needing to root the device. The malware spreads through fake Google Play websites promoted via messages and calls impersonating government agencies or banks. Once you install the fake app, it asks for Accessibility Service permissions, and if granted, it quietly enables Developer Options and Wireless Debugging in the background, connects to itself, and opens a backdoor with 53 possible commands — including screen streaming, app installation, contact theft, camera activation, and fake dialog creation designed to steal your login credentials.
Because RedHook uses a built-in Android feature (Wireless ADB) rather than exploiting a software bug, it works on any Android phone or tablet running Android 11 or later, and doesn’t require any special hardware or computer connection. Security researchers at ThreatFabric discovered the upgraded technique and confirmed it works across all modern Android devices as long as the Accessibility permission is approved.
How to check if you’re affected
Affected devices are any Android phone or tablet running Android 11 or later where the user may have approved an Accessibility permission for an unfamiliar app.
- Open Settings → Accessibility and review which apps have permission. Revoke access for any app you don’t recognize or didn’t intentionally grant it to.
- Open Settings → Developer Options — if this is turned on and you didn’t enable it yourself, that’s a red flag.
- Install apps only from the official Google Play Store. If you downloaded any “Google Play” app from a link in a message or call, uninstall it immediately.
- Make sure Google Play Protect is active: open the Play Store, tap your profile icon, then Play Protect → Scan.