RedHook, LabubaRAT, and other mobile malware families widen Android abuse

Several mobile malware reports this week showed attackers expanding their Android tradecraft. RedHook was observed using Wireless ADB to gain shell access without a computer connection, while other campaigns focused on fake apps and trojanized installers to harvest credentials or stage post-compromise activity. The stories also included banking and session-theft behavior tied to mobile infection chains, showing that attackers increasingly treat phones as full operational footholds rather than secondary devices. This matters because mobile compromise can directly undermine MFA, messaging, banking, and corporate access workflows. The evolution of Android malware toward easier privilege acquisition and stealthier installation makes device hygiene and application vetting more important than ever. Defenders should assume mobile endpoints are part of the enterprise attack surface, not just personal accessories.

Sources

• RedHook Android malware now uses Wireless ADB for shell access — Lifeboat — Cybercrime & Malcode
• RedHook Android malware now uses Wireless ADB for shell access — /r/cybersecurity
• LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software — Help Net Security