A piece of malware called RedHook just got an upgrade, and what it can do now should make every Android user put down their phone and pay attention for exactly two minutes. The new version, documented by cybersecurity firm Group-IB on July 9, 2026, can hijack your phone's Wireless Debugging feature to gain shell-level access — meaning it can operate your device like a remote-controlled toy, tapping buttons, changing settings, and draining your bank account without you ever seeing a pop-up.
Fifty-three commands. That's how many tricks this thing has now. Up from 34 when Cyble researchers first caught it in the wild back in July 2025.
The malware abuses Android's Wireless ADB — a legitimate developer tool — to gain what's called uid 2000 shell-level privileges. In plain English, it gets enough access to install apps, delete apps, and change your settings without ever asking your permission.
It doesn't stop there. RedHook can watch your screen in real time, record every keystroke you type, steal your login credentials, intercept SMS verification codes, and take screenshots. That two-factor authentication text your bank sends you? RedHook reads it before you do.
The malware is currently targeting users in Vietnam and Indonesia, spreading through fake phone calls and text messages that impersonate banks and government agencies. Attackers also set up Google Play lookalike websites to trick people into downloading malicious apps. The malware includes brand-specific code for seven major phone manufacturers — Google, Huawei, Meizu, Oppo, Samsung, Vivo, and Xiaomi — meaning the developers built custom attack routines for each one.
The persistence mechanisms are what separate RedHook from your garden-variety phone virus. It uses something called one-pixel activity spoofing to stay invisible, runs a verification check every five minutes to make sure it hasn't been killed, and registers itself to restart automatically every time you reboot your phone. It even adjusts its own priority score to prevent Android's memory manager from shutting it down. This thing clings to your phone like a barnacle on a submarine.
Now here's the part that actually matters — how this thing gets on your phone in the first place. The attacker still needs you to do two things: install a malicious app from outside the official app store, and then approve powerful Accessibility permissions when the app asks for them.
Which means the fix is dead simple. Don't sideload apps. If it didn't come from the Google Play Store, don't install it. If an app you just downloaded immediately asks for Accessibility permissions, that's a red flag the size of a billboard. And go into your phone's Developer Options right now and make sure Wireless Debugging is turned off. If you've never turned it on, it's already off — leave it that way.
The cybersecurity industry loves to make these threats sound like unstoppable digital plagues. RedHook is sophisticated, no question — 53 commands, seven OEM-specific attack profiles, persistence that survives reboots. But it still can't get on your phone without your help.
Every few months we get another one of these stories, and every few months the answer is the same: stop installing random apps from links strangers text you. The malware keeps getting smarter. The entry point hasn't changed in a decade.