New Android Trojan Steals Money from Bank Accounts Undetected

Experts from Group-IB have discovered an updated version of the RedHook Trojan, which can steal funds from Android users' bank accounts. The malware exploits vulnerabilities in wireless Android Debug Bridge (ADB) to gain elevated access, allowing attackers to bypass standard security mechanisms.

The Trojan spreads through phishing schemes: victims receive links via SMS, emails, or social media messages. Attackers impersonate employees of well-known companies or technical support, convincing users to install an APK file from a fake website. After installation, the Trojan requests Accessibility permissions to activate wireless ADB and take control of the device.

The updated version of RedHook employs advanced masking techniques, including a self-recovery mechanism via two interconnected services. This makes the Trojan nearly impossible to remove using standard methods. Additionally, the malware can keep the device active by creating an invisible pixel on the screen to prevent the system from terminating it.

Initially, attacks were detected in Vietnam, but the threat has now spread to Indonesia and other countries in the region. Experts recommend users avoid installing apps from unofficial sources and carefully review requested permissions. In the future, Google plans to enhance security by disabling access to Developer options for regular users.