[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRl1BQ8SUtCJYhdjf8DMsRwaiUbMCK49Q240SEQ-pqus":3},{"article":4,"iocs":50,"watch_terms":62,"solutions":63,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"5180831f-ba60-40a4-ba53-e80136d3b6ea","RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service","redwing-maas-packages-android-bank-fraud-as-a-telegram-rental-service-319811","A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill criminals take over a victim's phone, steal their banking logins, and capture the one-time codes that protect their accounts. Zimperium's zLabs, which found the operation, says it looks like a new variant of Oblivion, a $300-a-month rent-a-malware tool","A new Android malware operation named RedWing is being offered as a rental service on Telegram, enabling low-skill criminals to steal banking credentials and one-time passcodes. This \"malware-as-a-service\" (MaaS) package, potentially a variant of Oblivion, provides custom-built apps, tutorials, and evasion techniques. It targets users through phishing links that lead to fake app stores, requesting extensive permissions including Accessibility services to gain control over the device.","RedWing MaaS offers Android bank fraud tools via Telegram rental service.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fredwing-maas-packages-android-bank.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjdqPEGRKkKA7pjGNpR8hijHzJLPvyPD1g1C8bTt91eLUOFdu6Jw99i8LFybvHG9SP3syQ8shdXpC6EhinlQoB9aTgBMtejiCWAzVhhTi0o3nCTKZeKNnwDY0J_Lbf9LGN-KIQIoJ7-GW2op-JUcBg64uz5Actwh7TsFEstwNx9fXnLj4SODskUpnX9TPE\u002Fs1600\u002Fandroid-trojan-telegram.jpg","2026-07-07T17:10:15+00:00","2026-07-07T18:00:23.580243+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"RedWing","product",{"name":21,"type":19},"Oblivion",{"name":23,"type":24},"Telegram","technology",{"name":26,"type":27},"Zimperium","vendor",{"name":29,"type":19},"Fantasy Hub",{"name":31,"type":19},"Albiriox","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,53,55,57,59],{"type":36,"value":18,"context":52},"Name of the new Android banking trojan MaaS operation.",{"type":36,"value":21,"context":54},"Previous rent-a-malware tool that RedWing may be a variant of.",{"type":36,"value":29,"context":56},"Similar Russian-market rental kit mentioned in the article.",{"type":36,"value":31,"context":58},"Another banking trojan with similar techniques.",{"type":36,"value":60,"context":61},"Klopatra","Banking trojan using similar techniques like hidden remote control and fake overlays.",[26,18,21],{"controls":64,"vendors":152},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":124,"name":125,"problem":126,"products":127},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[],{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":170},"redwing-maas-turns-android-bank-fraud-into-a-telegram-rental-service","RedWing MaaS Turns Android Bank Fraud Into a Telegram Rental Service","RedWing lowers the barrier to cybercrime by packaging sophisticated Android banking malware as a rental service on Telegram, complete with tutorials and evasion tools, enabling even unskilled criminals to steal credentials and one-time passcodes. Victims are lured via phishing links to fake app stores where malicious apps request dangerous permissions — particularly Android Accessibility Services — giving attackers near-total device control. This matters because the MaaS model dramatically scales the threat: one skilled developer can arm hundreds of criminals simultaneously. Organizations and individuals remain vulnerable when they do not scrutinize app sources, over-grant permissions, or lack defenses against phishing-delivered malware.",[158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-124 Rev. 2 – Guidelines for Managing Mobile Device Security","NIST AC-6 – Least Privilege","NIST SI-3 – Malicious Code Protection","NIST IA-5 – Authenticator Management (phishing-resistant MFA)","GDPR Article 32 – Security of Processing (for organizations handling EU customer banking data)","PCI DSS Requirement 6 – Develop and Maintain Secure Systems","PCI DSS Requirement 8 – Identify and Authenticate Access to System Components","OWASP Mobile Top 10 – M1: Improper Platform Usage (Accessibility Service abuse)",{}]