Researchers have discovered RedWing, an Android spyware operation being sold as a subscription service via Telegram, with suspected ties to Russian threat actors. This sophisticated Malware-as-a-Service (MaaS) product lowers the barrier to entry for novice attackers, providing documentation, tutorial videos, and a bot that customizes and builds malicious applications on demand. The entire process, from app customization to building, can be managed through Telegram.
Infection typically begins with a phishing link that directs users to a fake app store page, designed to mimic legitimate stores like Google Play, Samsung Galaxy Store, or Huawei's AppGallery, complete with fake ratings and reviews. Once installed, the malware guides the user through a series of permission requests, including disabling battery optimization for persistent background operation, setting itself as the default SMS handler to intercept two-factor authentication codes, and gaining access to notifications.
With these permissions, RedWing gains extensive control over the device. It can display fake login screens over legitimate banking and cryptocurrency applications to steal credentials. Furthermore, it leverages Android's Accessibility Service to capture PINs, card numbers, and CVV values directly from the screen as they appear. The malware can also silently enable call forwarding using a hidden carrier code, redirecting all incoming calls to an attacker-controlled number, thereby disabling phone-based two-factor authentication and fraud prevention calls.
The spyware's surveillance capabilities extend to remotely activating the device's camera and microphone. Attackers can send commands to capture images or record ambient audio for configurable durations, managed entirely from the remote server. Additional features include live screen streaming via VNC, a real-time keylogger, access to all files on the device, contact lists, call logs, and location tracking.
RedWing's architecture suggests that specific target lists for overlays can be updated remotely, while the applications it monitors through Accessibility are compiled into each custom APK. Researchers identified 82 targeted institutions, with a notable focus on Russian financial firms. The operation does not exploit any Android vulnerabilities, relying instead on users installing apps from unofficial sources and granting excessive permissions.
Beyond espionage and data theft, RedWing can transform compromised Android devices into a botnet capable of launching coordinated Distributed Denial of Service (DDoS) attacks. Attackers can command multiple infected phones simultaneously to flood target websites or servers with traffic, disrupting their availability.
Given that operators can easily reskin the app and change its targets, focusing on the app's name is less effective than observing its behavior. The rise of MaaS operations like RedWing highlights the ease with which attackers can weaponize legitimate Android components for full device compromise through social engineering and the abuse of critical system permissions.
