Loading malware…
RedWing is an Android banking trojan with remote-access and information-stealing variants, operated as a commercial malware-as-a-service offering through Telegram. Its subscription service provides a bot for generating and obfuscating customer-specific applications, an operator control panel, customizable phishing pages, documentation, and referral incentives. Targeting emphasizes Russian users and financial organizations; analyzed configurations included 82 institutions, predominantly Russian financial firms, alongside cryptocurrency services.
Infections rely on social engineering and user-approved sideloading rather than exploitation of Android vulnerabilities. Distribution uses phishing links, counterfeit app-store pages, applications impersonating legitimate software, and fake update prompts. After installation, deceptive onboarding screens persuade victims to enable Accessibility services, notification access, default SMS handling, and battery-optimization exemptions.
RedWing overlays fraudulent login screens on banking and cryptocurrency applications to capture credentials, payment-card information, PINs, and cryptocurrency seed phrases. It intercepts SMS authentication codes and silently enables call forwarding to divert voice-based verification and bank fraud-check calls. Remote-control and surveillance capabilities include VNC-style screen streaming, screenshots, keylogging, simulated interaction, device locking, camera capture, microphone recording, and location tracking. It also steals messages, contacts, call logs, files, and photographs. Additional functionality supports proxy tunneling and coordinated DDoS attacks from infected devices.
RedWing uses obfuscation, encrypted dynamically loaded code, icon hiding, and interference with security controls to evade detection and removal. Persistence mechanisms include battery-optimization exemptions, background silent-audio playback, and scheduled restarts. Operators can customize credential-harvesting overlays and update overlay targets through the control panel without redistributing the application.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Operators could also generate fake app-store pages, mimicking Google Play, the Galaxy Store, AppGallery or Russia's RuStore, complete with bogus ratings and download counts to lure victims into installing it.
«Может планировать собственный перезапуск на 3:15 утра».
Notably, RedWing needs no Android exploit. It relies entirely on the user sideloading the app and approving its permission requests.
«После запуска вредоносное приложение отображает фейковую страницу Google Play и предлагает пользователю установить “обновление”».
«Может планировать собственный перезапуск на 3:15 утра».
It then pushes for Android’s Accessibility Service. That permission is the master key. With it, RedWing can read the screen, simulate taps, and lift data as it appears.
«Может планировать собственный перезапуск на 3:15 утра».
It then pushes for Android’s Accessibility Service. That permission is the master key. With it, RedWing can read the screen, simulate taps, and lift data as it appears.
«Малварь маскируется под легитимные приложения и видеофайлы»; в первой кампании ее выдавали за приложение RadarTrevog, а другой образец назывался «Видео с места аварии».
«Скрывается из списка недавних программ».
Watch for an app that hides its icon after it installs, a common trick for staying out of sight.
«Может самостоятельно выдавать себе дополнительные разрешения и даже пытаться отключить Google Play Protect»; «мешает пользователю открыть настройки, файловые менеджеры и антивирусы, блокирует попытки удаления».
RedWing's core trick was credential harvesting through fake overlays. When a victim opened a targeted banking or cryptocurrency app, it dropped a convincing login screen on top to steal their details...
«RAT-версия RedWing содержит кейлоггер».
«Перехватывает ... PIN-коды, пароли и графические ключи», а также «может накладывать фишинговые оверлеи поверх настоящих банковских приложений».
It deploys fake login screens over real banking and crypto apps to steal credentials...
Once installed, the app walks the victim through permission screens one at a time... set the app as the default SMS handler... reads incoming texts to capture one-time codes.
To defeat two-factor authentication (2FA), the malware intercepted SMS codes...
It also provided live VNC screen control...
Operators can trigger the camera and microphone, read files, steal contacts and call logs, and track location.
RedWing's core trick was credential harvesting through fake overlays. When a victim opened a targeted banking or cryptocurrency app, it dropped a convincing login screen on top to steal their details...
«RAT-версия RedWing содержит кейлоггер».
«Перехватывает ... PIN-коды, пароли и графические ключи», а также «может накладывать фишинговые оверлеи поверх настоящих банковских приложений».
It deploys fake login screens over real banking and crypto apps to steal credentials...
«Малварь способна транслировать экран, делать снимки».
«RAT-версия RedWing ... перехватывает данные из буфера обмена».
«Записывать звук с микрофона».
«Передавать видео с камер устройства».
RedWing reports each granted permission to its C2 in real time. That telemetry tells operators which commands will work.
«Зараженный смартфон можно превратить в прокси-сервер».
On top of that, operators get live screen streaming via VNC...
«Встроенный в приложение DDoS-движок поддерживает возможность проведения атак в режимах HTTP-flood, POST-flood и Slowloris».
Infected phones can even be pooled into a DDoS botnet.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.