Loading story…
Researchers reported RedWing, a newly identified Android spyware and malware-as-a-service operation marketed through Telegram and distributed via sideloaded apps and mobile phishing pages. The service packages custom droppers, fake app-store lures, phishing templates, operator guides, and subscription tiers that lower the barrier for bank-fraud actors. Investigators said the campaign heavily targets financial institutions—especially Russian banks and crypto services—and currently includes targeting for 82 institutions across multiple sectors, with infrastructure and tradecraft suggesting a strong Russian-market orientation.
Once installed and granted permissions, RedWing gives operators extensive control over infected devices by abusing Android Accessibility Services, overlay permissions, default SMS handler privileges, and MediaProjection. The malware can harvest credentials and one-time codes, intercept SMS, enable call forwarding, stream the screen, log keystrokes, capture audio and camera feeds, and access files, contacts, call logs, and location, allowing it to bypass SMS- and voice-based 2FA. Researchers also found similarities to the Oblivion malware family and said RedWing can dynamically update targeted apps and phishing overlays from its command-and-control panel without requiring a new malware build.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Zimperium zLabs reported RedWing as a newly identified Android spyware and malware-as-a-service operation distributed via Telegram and mobile phishing sites. The report described a mature commercial toolkit targeting financial institutions, especially Russian banks and crypto services, and noted similarities to the Oblivion malware family.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceinfosecurity-magazine.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcezimperium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Android banking trojan **Red Alert** was observed targeting more than 60 banking applications across multiple countries, along with at least one social platform, **Instagram**, by displaying fake login overlays when victims opened selected apps. The malware checked which application was in the foreground and then pulled the appropriate overlay configuration from its command-and-control infrastructure, allowing it to capture usernames, passwords, and other entered data and send them back to attackers. Researchers reported that **Red Alert 2.0** was being distributed through third-party Android app stores while posing as legitimate software such as **WhatsApp**, **Viber**, Android updates, and **Flash Player** updates. Beyond credential theft, the trojan supported SMS interception and sending, changing the default SMS app, collecting contacts and call data, issuing USSD commands, launching apps, requesting admin privileges, and blocking incoming calls from banks to interfere with fraud checks; it was also reportedly advertised on underground forums for **$500**, raising concerns that more criminals could deploy it against Android devices up to version 6.0.
Aug 15, 2026
ThreatFabric researchers reported a new Android malware strain, **Manic**, that is being actively distributed in the wild and primarily targets users in Ukraine while also reaching victims across Europe and beyond. The malware combines mobile banking trojan behavior with spyware and remote-control functions, targeting at least **169 applications** tied to banks, government and eID services, payment platforms, cryptocurrency wallets, messaging tools, authenticator apps, and military-focused communications. Reported targets include Ukrainian banks and state services, as well as Russian and European financial institutions and global fintech and crypto services. Manic abuses Android **Accessibility** services and uses transparent keypad overlays to capture credentials and user input while legitimate apps continue to operate, enabling theft of PINs, passwords, SMS codes, and other sensitive data. Researchers said the malware also features an unusual fallback exfiltration method that sends encrypted stolen data through nearby infected devices over **Wi-Fi Direct** or **Bluetooth**, including multi-hop routing when a device lacks direct internet access. The campaign has reportedly been active since at least February, with wrapper-based payload delivery observed in late May and more advanced anti-analysis and in-memory DEX loading added in July.
Aug 21, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026