# RedWing MaaS: The Telegram-Based Android Banking Fraud Epidemic Now Renting to Any Criminal
## A New Malware-as-a-Service Platform Is Democratizing Mobile Bank Fraud, Turning Complex Attacks Into Plug-and-Play Crime
A sophisticated Android malware operation called RedWing is being marketed as a ready-made fraud service on Telegram, complete with subscription tiers, referral bonuses, and customer support — all designed to enable even non-technical criminals to steal banking credentials, intercept one-time passcodes, and drain victim accounts. Security researchers at Zimperium's zLabs discovered the operation and identified it as a new variant of Oblivion, a $300-per-month rent-a-malware platform documented earlier this year. The evolution signals a troubling shift in cybercriminal economics: Android mobile fraud is becoming as accessible and commodified as any other software service.
RedWing's sophistication lies not in novel exploitation techniques, but in its complete automation and user-friendly distribution model. A Telegram bot generates customized malicious apps on demand, deploys fake app-store pages tailored to each victim target, and provides operators with live remote access to infected devices. With a substantial portion of samples currently evading detection from conventional antivirus tools, the platform represents a significant threat to Android users globally, with particular focus on Russian financial institutions.
## The Threat: A Complete Mobile Fraud Toolkit
RedWing operates as a subscription service offering multiple tiers and referral incentives — an approach that mirrors legitimate software-as-a-service (SaaS) platforms. What differentiates this business model is that the "product" is a comprehensive mobile fraud suite designed to turn a smartphone into an attacker's tool.
The attack chain begins with a phishing link directing users to a fake app-store interface. The malware's dropper builder can convincingly replicate:
Once clicked, the page pressures users to install the app from "outside the official store," a critical step that bypasses the security protections of official app marketplaces.
### Permission Escalation and Abuse
RedWing employs a deliberate permission-request strategy that avoids triggering user suspicion. Rather than requesting all permissions upfront, the malware stages permission requests one screen at a time, framing each as routine:
The Accessibility Service permission is the linchpin. While designed to assist users with disabilities, it grants malware the ability to:
## How RedWing Steals Banking Access
Once Accessibility Service is enabled, RedWing has broad control of the infected device. The malware's capabilities include:
| Capability | Method | Impact |
|-----------|--------|--------|
| Login credential theft | Fake overlay screens over legitimate banking apps | Attacker gains account credentials |
| One-time passcode interception | Reads SMS messages + uses Accessibility to capture codes as they appear | Defeats second-factor authentication |
| Call forwarding hijacking | Activates hidden carrier code (*21*) to redirect incoming calls | Disables phone-based fraud verification and bank checks |
| Live remote operation | Real-time screen streaming and keylogging | Attacker can watch and control the phone during transactions |
| Device exploitation | Camera/microphone activation, file theft, location tracking | Complete privacy breach |
| Botnet abuse | Pooling infected phones to launch DDoS attacks | Amplified denial-of-service capability |
The on-device overlay technique is particularly insidious. When a victim opens their banking app, a fake login screen appears indistinguishable from the legitimate interface. The victim enters their credentials into the attacker's fake form, believing they are authenticating to the bank. The malware captures these credentials and can use them immediately or sell them to other criminals.
## Targeting and Geographic Focus
Zimperium's analysis identified 82 targeted financial institutions across multiple sectors. The evidence overwhelmingly points to a Russian-market focus:
However, researchers note that the targeting list is dynamic and can shift without notice, suggesting that RedWing's operators may expand beyond Russian institutions as the service matures and demand grows.
## Background: A Trend Within the Trend
RedWing does not emerge in a vacuum. It represents an escalation in a broader criminal movement toward on-device fraud — a technique where attackers operate *inside* a victim's legitimate banking session rather than compromising an account from the outside.
Comparable operations discovered in recent months:
The technical convergence of these platforms suggests either code reuse among Russian cybercriminal groups or an evolution in industry-standard attack methodology. Either way, defenders are facing a coordinated threat ecosystem where the tooling, techniques, and distribution methods are being actively shared and refined.
## Why RedWing Works: The Permission Model's Weakness
RedWing's continued success hinges on a fundamental design choice in Android: the permission system is not granular enough to protect against sophisticated use cases. Users must choose between granting broad permissions or losing app functionality. The Accessibility Service, in particular, was designed with good intentions — to aid users with disabilities — but provides no practical mechanism for users to understand what an app actually does with that access.
A malicious app with Accessibility Service enabled can:
An ordinary user has no way to distinguish between a legitimate accessibility app and a malicious one because the permission itself is binary: grant it or don't.
## Implications for Organizations and Individuals
### For Banking and Financial Institutions
### For Mobile Security Teams
### For Individual Users
The threat is immediate and personal. Any Android user can become a target.
## Recommendations: Defense Strategies
### For Individuals
### For Banking Apps and Developers
### For Security Teams and IT Leaders
---
## HackWire Analysis
RedWing represents a critical inflection point in Android malware economics: the convergence of technical sophistication with business-model accessibility. The platform's genius is not a novel exploit — RedWing requires no zero-day, no Android vulnerability. Instead, it weaponizes the *permission system itself* and combines that with social engineering so refined that the user installation experience feels almost legitimate.
What makes RedWing particularly dangerous is the MaaS subscription model. Malware has always been sold; what's new is the systematization. A Russian-speaking cybercriminal with no programming skills can now rent RedWing for a monthly fee, receive a Telegram bot that builds custom apps on demand, and operate a complete fraud operation without ever touching code. This is industrialization of crime. It mirrors the exact arc that happened with ransomware-as-a-service (RaaS) platforms like REvil and DarkSide — first a technical innovation, then a service model, then rapid mainstream adoption and law enforcement crackdowns.
The timing matters: RedWing emerges at a moment when defenders are already overwhelmed. The overlap with Fantasy Hub, Albiriox, and Klopatra is not coincidence — it suggests either a unified Russian cybercriminal ecosystem sharing code, or copycat operators cloning proven techniques. Either way, the financial incentive is aligned: banks hold money, and on-device fraud bypasses many modern defenses (tokenization, real-time fraud detection, geographic velocity checks) because the attacker operates *inside* the victim's session using the victim's device.
Banks have largely moved past SMS-based 2FA for high-value customers, but millions of consumers still rely on SMS codes or app-based TOTP tokens. RedWing's Accessibility Service abuse turns both into useless theater — the attacker sees the code before the user does, or operatess the banking app in real-time while the user watches their account drain in near-real-time.
The distribution strategy via phishing links and fake app stores is also telling. RedWing requires user install — no exploit — which means it depends entirely on social engineering. This is both a weakness (user education can prevent infection) and a strength (there is no technical patch that can stop it; it's a human problem).
Organizations should assume that if their employees are Android users, some fraction of them *will* be targeted by RedWing or a similar operation. The defense is layered: app-store-only installation, Accessibility Service audits, anomaly detection on the bank side, and continuous user education. No single control stops this threat.
— HackWire Editorial
---
## Related Coverage