RedWing: Android Bank Fraud Sold as a Telegram Subscription

There's a new Android malware kit doing the rounds called RedWing, and the sales pitch is depressingly professional. Pay a monthly fee on Telegram and you get a full bank-fraud operation off the shelf: a builder bot that generates a custom app, written guides, how-to videos, referral discounts, and a control panel for managing the people you're robbing. No coding required.

Zimperium's zLabs, which spotted the kit, reckons it's a rework of Oblivion, a $300-a-month rental tool documented earlier in the year. The polish is new. The technique isn't.

The attack is not clever, which is the point

A phishing link drops the victim on a fake app store page. It might imitate Google Play, Galaxy Store, or Huawei's AppGallery, or use a bespoke design complete with invented ratings and download counts. From there, the user is nudged into sideloading the app.

Once installed, it asks for permissions one at a time, in an order designed not to spook anyone:

• Turn off battery optimisation
• Become the default SMS handler
• Allow notifications
• Switch on Accessibility

That last one is the prize. Accessibility was built to help people with disabilities operate their phones, which means it can read what's on screen and tap through interfaces. Grant it to a malicious app and you've handed over your banking logins and the one-time codes meant to stop exactly this kind of fraud.

Buyers pick their own victims

Zimperium counted 82 targeted institutions, heavily weighted toward Russian financial firms, with one sample impersonating Russia's RuStore. Because overlay targets can be swapped from the control panel at any time, the same underlying malware keeps reappearing under new names, new logos, and new fake store pages. Researchers note that a lot of the resulting droppers slide past conventional mobile security tools.

RedWing sits alongside Fantasy Hub, Albiriox, and Klopatra, all part of a broader shift toward on-device fraud. Instead of stealing credentials to reuse elsewhere, the criminal operates inside the victim's own banking session on the victim's own phone. It's harder to detect at the bank's end and much harder to unwind once the money has moved.

The install is the whole game

None of this needs an Android exploit or a zero-day. It works because a person taps through prompts on a sideloaded app. That's the entire attack surface.

On managed fleets, two controls close most of the door before the rest of the story plays out: block sideloading outright, and flag any app that requests Accessibility or the default-SMS role. Both are rare enough in legitimate use that treating them as red flags costs almost nothing.

For everyone else, the useful thing to know is that a convincing app store page is not the same as an app store. Ratings can be invented. Download counts can be invented. The install button in a browser tab is not the one on your phone's actual store, and the difference matters more than it used to.