RedWing

RedWing is an Android spyware operation sold as a Malware-as-a-Service offering and distributed through Telegram-supported criminal infrastructure. It is designed to lower the barrier to entry for operators by providing subscription-based access to customizable malicious APK generation, obfuscation, onboarding flows, and centralized victim management. RedWing has been assessed as likely related to, or evolved from, the Oblivion malware family based on similarities in its dropper and overlay components, and reporting has noted links or apparent ties to Russian threat actors, although precise attribution remains unconfirmed.

RedWing is primarily delivered through mobile phishing pages that impersonate legitimate Android app stores and persuade victims to sideload malicious applications. Its infection flow relies on staged social engineering rather than exploitation of Android vulnerabilities. Victims are guided into granting high-risk permissions and roles, including Accessibility access, notification access, overlay privileges, device administration, battery optimization exemptions, and default SMS handler status. The malware abuses these legitimate Android features to gain deep visibility and control over the device.

Once installed, RedWing supports extensive surveillance, credential theft, and fraud-enablement functions. It can steal SMS messages, contacts, call logs, files, photos, and device metadata; intercept one-time passcodes; perform real-time keylogging; and use Accessibility and overlay mechanisms to harvest banking and cryptocurrency credentials, payment card data, PINs, and other sensitive information. It can also manipulate the device through simulated user actions, launch deceptive overlays, open applications, and update targeting and phishing injects from its control panel without requiring redistribution of a new sample.

RedWing also provides remote-control and post-compromise capabilities including live screen streaming via VNC-style functionality, screen capture, remote screen locking, microphone activation, camera activation, location access, proxy tunneling, and call-forwarding abuse to bypass voice-based authentication and fraud checks. In addition to espionage and financial theft functions, it can conscript infected devices into coordinated HTTP flood attacks, giving the operation botnet-style DDoS capability.

The malware communicates with a centralized command-and-control panel over HTTP and WebSocket and reportedly exposes a large command set for surveillance, device control, injection management, proxy session handling, and denial-of-service operations. Targeting observed for RedWing shows a strong emphasis on financial institutions, particularly Russian banks and cryptocurrency-related services, indicating a pronounced financial-crime orientation on Android devices.