RedWing MaaS: Analyzing the Oblivion Variant on Telegram
Just saw the Zimperium report on RedWing. It’s another "Banking-as-a-Service" kit popping up on Telegram. The researchers link it to the Oblivion malware family, but the rental model here is particularly aggressive. It’s lowering the barrier to entry significantly—actors don't need coding skills, just the subscription fee to steal banking logs and 2FA tokens.
Technically, it leverages Android's Accessibility Services to draw overlays on legitimate banking apps. It captures credentials directly from the UI and intercepts incoming SMS for 2FA bypass. Because it uses Telegram as a C2 channel, network detection can be noisy if you don't have deep SSL inspection.
Detection Strategies
Standard AV might struggle if the payload is obfuscated. I recommend checking for apps requesting BIND_ACCESSIBILITY_SERVICE that aren't screen readers or accessibility tools. If you are doing mobile forensics or static analysis, here is a basic YARA rule to start hunting for the overlay characteristics:
yara rule RedWing_Overlay_Indicators { meta: description = "Hunts for RedWing/Oblivion accessibility service abuse" author = "SecurityArsenal" strings: $perm = "android.permission.BIND_ACCESSIBILITY_SERVICE" nocase $sms = "READ_SMS" nocase $overlay = "android:type="systemOverlay"" nocase condition: uint16(0) == 0x5a4d and 2 of ($m*) }
If you see these permissions combined with requests for Overlay permissions in the manifest, treat it as high risk.
How is everyone handling the "shadow IT" problem where users install these apps outside the Play Store? Are you enforcing strict Knox/Workspace profiles to isolate banking apps?
We've seen a spike in these variants targeting financial institutions in EMEA. The Telegram C2 is the biggest headache for us because blocking the domain often leads to pushback from management. We've moved to a Mobile Threat Defense (MTD) solution that focuses on behavior analysis rather than signatures—specifically watching for 'Accessibility Service' activation outside of known assistive apps. It catches the overlay attempt before the UI can be spoofed.
From a pentester's view, the delivery mechanism is usually the weak link. RedWing itself is capable, but it still needs the user to side-load the APK. We're finding that smishing (SMS phishing) campaigns are the primary vector. The payload usually arrives as a 'Security Update' or 'Banking App Update.' Defenders should focus on user awareness regarding unofficial app stores more than the technical malware specifics right now.
The link to Oblivion is interesting. We handled an incident last month where the malware checked for the device locale. If it detected a non-target region (based on MCC/MNC), it wouldn't deploy the overlays. If you're analyzing logs, check for adb install commands or pm install events from unverified sources immediately following the installation of a 'clean' looking utility app.
Great insights everyone. Since RedWing relies heavily on abusing Accessibility Services, a quick triage step during device forensics is checking exactly which packages hold that permission. You can pull this directly from a suspect device using ADB to spot anomalies quickly.
adb shell settings list secure | grep enabled_accessibility_services
This often reveals the overlay component without needing immediate full static analysis.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access