A sophisticated new variant of the RedHook Android malware is exploiting Wireless ADB (Android Debug Bridge) to gain unauthorized shell access, enabling attackers to silently drain bank accounts without detection, cybersecurity researchers have warned. The malware, identified by Group-IB, represents a dangerous evolution in mobile banking threats, particularly targeting users in India, where digital payments and smartphone adoption are surging.
What Happened?
Security researchers at Group-IB first detected the upgraded RedHook malware strain in early 2026, revealing that it now leverages Wireless ADB—a feature typically used by developers for remote debugging—to establish a persistent backdoor on infected devices. Once installed, the malware disguises itself as a legitimate system process, making it difficult for standard antivirus tools to detect.
According to BleepingComputer, the malware spreads primarily through fake banking apps and trojanized utility applications, often distributed via third-party app stores or phishing links. A fake “PDF reader” app, reported by the Darlington & Stockton Times, has been identified as a key vector for infections, with users reporting unauthorized transactions within hours of installation.
The malware’s most alarming capability is its ability to mimic near-field communication (NFC) transactions, a tactic that has surged 188% in recent months, according to a report by The Daily Guardian. By spoofing NFC-based payments, RedHook can siphon funds even when users are not actively using their banking apps.
Once inside a device, the malware can:
– Intercept SMS-based two-factor authentication (2FA) codes, bypassing an additional layer of security.
– Log keystrokes to capture login credentials for banking apps, email accounts, and other sensitive platforms.
– Modify app permissions to grant itself administrative control, allowing it to disable security features.
– Disable security notifications, preventing users from receiving alerts about suspicious activity.
Why It Matters
The RedHook malware poses a significant threat to Android users, particularly in India, where mobile banking and digital payments have become ubiquitous. With over 500 million smartphone users in the country, a substantial portion relies on UPI (Unified Payments Interface) and mobile wallets for daily transactions. The malware’s ability to bypass traditional security measures—including Google Play Protect—makes it especially dangerous.
Wireless ADB exploitation is particularly concerning because:
– It does not require physical access to the device, allowing attackers to maintain remote control.
– It evades behavioral detection by mimicking legitimate system processes, making it harder for antivirus software to flag.
– It bypasses Google Play’s security scans, which primarily check for malicious code at the time of installation rather than during runtime.
The surge in NFC-based attacks—up 188% in recent months—further complicates the threat landscape, as digital payment adoption continues to grow. In India, where contactless payments are increasingly common, users may be unaware that their devices are being exploited to authorize fraudulent transactions.
Background and Context
The RedHook malware family first emerged in 2023 as a banking trojan targeting European and Southeast Asian users. Early versions relied on overlay attacks, where the malware would display fake login screens to trick users into entering their credentials. However, the latest variant represents a major shift in tactics, moving away from user interaction toward silent, background exploitation.
The use of Wireless ADB is a relatively new attack vector in Android malware. ADB is a developer tool that allows remote debugging and command execution on Android devices. While it is typically disabled by default, some users enable it for rooting, app development, or remote troubleshooting. Attackers have now weaponized this feature to gain root-level access without the user’s knowledge.
India’s rapid digital transformation has made it a prime target for cybercriminals. The country’s UPI system, which processes billions of transactions monthly, has become a lucrative target for fraudsters. Additionally, the prevalence of sideloading apps from unofficial sources increases the risk of malware infections, as users bypass Google Play’s security checks.
Competing Claims and Uncertainty
While Group-IB and BleepingComputer have provided detailed analyses of RedHook’s capabilities, some aspects of the malware’s spread remain unclear:
1. Attribution – Cybersecurity firms have not yet attributed the malware to a specific hacking group or nation-state actor. Some researchers speculate that the malware may be linked to financially motivated cybercriminal gangs, given its focus on banking fraud.
2. Google’s Response – Google has not issued an official statement on RedHook, though the company has previously blocked malicious apps linked to similar malware campaigns. It remains unclear whether Google Play Protect has been updated to detect this new variant.
3. User Awareness – While cybersecurity experts warn about the dangers of sideloading apps, many users in India continue to download applications from third-party stores due to regional app availability or cost considerations. The effectiveness of public awareness campaigns in mitigating this threat is still uncertain.
4. NFC Attack Surge – The 188% increase in NFC-based attacks, reported by The Daily Guardian, raises questions about whether this is a global trend or region-specific. Some experts argue that the surge may be linked to India’s rapid adoption of contactless payments, while others suggest it could be part of a broader shift in cybercriminal tactics.
What to Watch Next
As the RedHook malware continues to evolve, several key developments could shape its impact:
1. Google’s Security Updates – Whether Google will enhance Play Protect to detect Wireless ADB exploits or issue emergency patches for vulnerable Android versions remains to be seen.
2. Banking Sector Response – Indian banks and UPI service providers may introduce additional security measures, such as biometric authentication or AI-based fraud detection, to counter the threat.
3. Law Enforcement Action – If the malware is traced to a specific cybercriminal group, authorities in India or other affected countries may launch investigations or takedown operations.
4. User Behavior Shifts – The effectiveness of public awareness campaigns in reducing sideloading and unofficial app installations will be critical in limiting infections.
5. Evolution of Attack Techniques – Cybercriminals may further refine NFC spoofing or Wireless ADB exploitation, potentially targeting other mobile operating systems or IoT devices.
Conclusion
The RedHook malware represents a dangerous escalation in Android banking threats, particularly for users in India, where digital payments are deeply embedded in daily life. By exploiting Wireless ADB and NFC spoofing, the malware operates silently in the background, making it far harder to detect than traditional banking trojans.
While cybersecurity firms have provided clear guidance on how users can protect themselves—such as avoiding sideloading, disabling Wireless ADB, and monitoring bank statements—the rapid evolution of malware tactics underscores the need for continuous vigilance.
For now, the burden falls on users, banks, and tech companies to adapt quickly to this emerging threat. Whether through enhanced security measures, stricter app store policies, or public education, the fight against RedHook and similar malware will require a coordinated effort to prevent financial losses and safeguard digital trust.
Story synopsis gathered from: Google News India – Technology — source.
Corrections
If you believe this article contains an error, contact Herald Express with the source URL and supporting evidence.
Story synopsis gathered from: Google News India – Technology — source.
