RedWing Android MaaS Enables Banking Fraud via Telegram and Phishing Sites
Threat Actor Intelligence · 5 sources · Updated 3mo ago · First seen Jul 7, 2026
Researchers reported RedWing, a newly identified Android spyware and malware-as-a-service operation marketed through Telegram and distributed via sideloaded apps and mobile phishing pages. The service packages custom droppers, fake app-store lures, phishing templates, operator guides, and subscription tiers that lower the barrier for bank-fraud actors. Investigators said the campaign heavily targets financial institutions—especially Russian banks and crypto services—and currently includes targeting for 82 institutions across multiple sectors, with infrastructure and tradecraft suggesting a strong Russian-market orientation.
Once installed and granted permissions, RedWing gives operators extensive control over infected devices by abusing Android Accessibility Services, overlay permissions, default SMS handler privileges, and MediaProjection. The malware can harvest credentials and one-time codes, intercept SMS, enable call forwarding, stream the screen, log keystrokes, capture audio and camera feeds, and access files, contacts, call logs, and location, allowing it to bypass SMS- and voice-based 2FA. Researchers also found similarities to the Oblivion malware family and said RedWing can dynamically update targeted apps and phishing overlays from its command-and-control panel without requiring a new malware build.
