RedHook: A New Android Banking Trojan Targeting Users In Vietnam

RedHook is a newly discovered Android banking trojan targeting Vietnamese users via spoofed government and banking websites that distribute malicious APKs; it abuses accessibility and overlay permissions, uses WebSocket-based RAT connectivity (skt9/api9 domains), supports 34 remote commands, captures screens via MediaProjection, keylogs, exfiltrates credentials and images to an exposed AWS S3 bucket, and has low antivirus detection with evidence of hundreds of infections.