RedHook Android malware can quietly hijack your phone - Fox News

What the report says

Fox News reported on a new version of the RedHook Android malware that can take extensive control of a phone after a victim installs a malicious app file and grants powerful permissions. Citing research from cybersecurity firm Group-IB, the report says the remote access trojan is being spread through social engineering, with criminals posing as banks, government services or support staff and directing targets to fake pages that may resemble Google Play. The app is installed from outside the official store as a sideloaded APK.

According to the report, RedHook abuses Android Accessibility permissions to read the screen and perform actions such as taps and navigation. It then uses that control to enable Developer Options and Wireless Debugging, a feature normally intended for developers using Android Debug Bridge. Group-IB said the malware can pair with the device locally and gain shell-level privileges, giving it more power than an ordinary app, though not full root access.

Fox News said the upgraded malware can stream or capture the screen, record keystrokes, gather contacts and text messages, simulate gestures, install or remove apps, show fake verification screens or overlays, and issue commands that lock, unlock, wake or reboot the device. The report also says RedHook includes methods to remain active, including restarting services, running checks after reboot and using techniques that make Android less likely to shut it down.

The development matters because it turns familiar scam tactics into deeper device compromise if a user follows urgent instructions. Fox News advised readers to be wary of requests to install apps from links, enable Accessibility for apps without a clear need, turn on Developer Options, or allow Wireless Debugging unexpectedly. General Android safety guidance is to use official app stores, verify urgent requests through known contact channels and remove suspicious apps promptly.