RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service

Cybersecurity researchers have uncovered a concerning new malware-as-a-service (MaaS) operation dubbed RedWing that dramatically lowers the barrier to entry for cybercriminals targeting banking customers. This Android-based malware kit is being distributed through Telegram channels, allowing even low-skill threat actors to launch sophisticated banking fraud campaigns with minimal technical expertise. The discovery highlights the continued evolution of malware commoditization in underground markets.

RedWing functions as a comprehensive bank fraud toolkit that provides criminals with the capability to completely compromise a victim's Android device. Once installed, the malware can intercept banking credentials, hijack banking sessions, and capture the one-time passcodes (OTPs) that serve as critical security layers for mobile banking applications. The malware's operator model follows a subscription-based approach, similar to other cybercrime tools, with researchers noting its resemblance to Obl