RedHook Abuses Accessibility Service to Enable Developer Options and Wireless Debugging

Gbhackers •Mayura Kathir • July 9, 2026

RedHook, an Android Remote Access Trojan (RAT) first profiled in July 2025, has resurfaced with a markedly more dangerous capability: autonomous abuse of Android’s ADB Wireless Debugging to acquire shell-level privileges (uid 2000). While its baseline toolkit screen streaming, keylogging, Accessibility-driven UI manipulation and credential theft remains intact, the latest RedHook builds demonstrate a deliberate […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RedHook RAT Exploits ADB Wireless Debugging for Deeper Android Control RedHook, an Android Remote Access Trojan first identified in July 2025, has re-emerged with enhanced capabilities. It now autonomously abuses Android's ADB Wireless Debugging feature to gain shell-level privileges, allowing it to manipulate devices more effectively. The malware retains its original toolkit, which includes screen streaming, keylogging, and credential theft. This new method bypasses traditional security measures by leveraging legitimate developer tools. Users of Android devices are particularly at risk, as the malware can operate without complex exploits. The current status indicates that RedHook is actively being distributed, posing a significant threat to Android security. Security professionals are advised to monitor for signs of this malware and implement protective measures. 3 sources 65

Extracted Entities

RedHook Abuses Accessibility Service to Enable Developer Options and Wireless Debugging

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)