RedWing: Democratizing Android Bank Fraud via Telegram MaaS
Just caught the Zimperium report on RedWing. It looks like the barrier to entry for mobile banking fraud is dropping rapidly. This new MaaS operation, riffing off the older Oblivion malware, is being peddled on Telegram for roughly $300/month.
From a technical standpoint, RedWing relies heavily on abusing Android's Accessibility Services. Once granted, it can read the screen, execute gestures, and—most critically—deploy overlay attacks to capture credentials and 2FA codes in real-time. Since it’s rented out as a turnkey package, the operators likely provide the C2 panels, leaving the "affiliates" to just handle the distribution.
For those hunting on the endpoint, keep an eye out for apps requesting BIND_ACCESSIBILITY_SERVICE alongside suspicious network permissions. If you have adb access on a test device, you can dump the active accessibility services to check for anomalies:
adb shell dumpsys accessibility
We’ve also seen indicators suggesting specific packer usage to evade static analysis. How are you guys handling the detection of overlay abuse in your BYOD environments? Are standard MDMs catching this, or are we leaning heavily on Mobile Threat Defense (MTD) solutions?
The $300 price point is the scary part. It's commoditized fraud. In our red team exercises, we've found that overlay attacks are incredibly effective against users who just blindly click 'Allow' on permission prompts. We've started testing user awareness training that specifically simulates these overlay pop-ups rather than just phishing emails.
It’s essentially Oblivion v2. We’ve been tracking similar IOCs in our honeypots. If you're looking to detect the C2 traffic, check for long-lived connections to endpoints with high entropy subdomains, often over non-standard ports. The Telegram integration is just for the storefront; the actual data exfil usually goes to a dedicated VPS to avoid Telegram's internal scanning.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access