New Android Threat: Malware Uses ADB to Bypass Protections

Cybersecurity experts from Group-IB have identified a new type of threat to Android devices called RedHook. This Trojan (RAT) uses a specific installation method that allows it to bypass the operating system's standard defense mechanisms and the Google Play Store.

The key element in the attack is the use of Android Debug Bridge (ADB). This tool, intended for developers, allows remote access and control of the device. The malware attempts to activate ADB by using the privileges of a specific user (UID 2000), which enables it to install APK files without the user's knowledge and without the need for traditional authorization.

RedHook not only installs malicious code but also strives to remain undetected. It uses the WakeLock mechanism to keep the device active and perform background tasks, such as: stealing personal data, spying via the microphone and camera, and sending text messages.

How to protect yourself?

• Do not enable "Debugging": Avoid turning on the debugging option in your device settings unless you are a developer and understand the risks.
• Be careful with APK files: Do not install applications from outside the official Google Play Store.
• Watch for unusual behavior: If you notice unexpected battery drain, overheating, or strange screen actions, check your device for the presence of malware.

Although the attack is sophisticated and requires certain technical conditions, it poses a serious risk to users who leave their devices in unprotected environments or do not follow basic digital hygiene rules.