RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service
RedWing MaaS offers Android bank fraud tools via Telegram rental service.
A new Android malware operation named RedWing is being offered as a rental service on Telegram, enabling low-skill criminals to steal banking credentials and one-time passcodes. This "malware-as-a-service" (MaaS) package, potentially a variant of Oblivion, provides custom-built apps, tutorials, and evasion techniques. It targets users through phishing links that lead to fake app stores, requesting extensive permissions including Accessibility services to gain control over the device.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Zimperium?
Get an email when a new story names Zimperium, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonRedWing lowers the barrier to cybercrime by packaging sophisticated Android banking malware as a rental service on Telegram, complete with tutorials and evasion tools, enabling even unskilled criminals to steal credentials and one-time passcodes. Victims are lured via phishing links to fake app stores where malicious apps request dangerous permissions — particularly Android Accessibility Services — giving attackers near-total device control. This matters because the MaaS model dramatically scales the threat: one skilled developer can arm hundreds of criminals simultaneously. Organizations and individuals remain vulnerable when they do not scrutinize app sources, over-grant permissions, or lack defenses against phishing-delivered malware.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — RedWing
- malware — Oblivion
- malware — Fantasy Hub
- malware — Albiriox
- malware — Klopatra