Red Wing MaaS Packages Android Bank Fraud as a Telegram Rental Service

Summary: Zimperium's zLabs found RedWing, an Android bank-fraud kit rented on Telegram in subscription tiers with referral discounts, guides, and how-to videos, and a bot that builds each buyer a custom app on demand. Infection begins with a phishing link to a fake app-store page mimicking Google Play, Galaxy Store, or AppGallery, and the app stages permission requests one screen at a time, including Android's Accessibility service, to read the screen and control the phone. Zimperium counted 82 targeted institutions, with a strong focus on Russian financial firms.
Why it matters: A buyer with no malware-writing skill can rent this kit and get a custom-built app, and researchers say a substantial number of the resulting droppers and payloads currently evade conventional security tools. Because overlay targets can be swapped from a control panel without shipping a new app, the same code resurfaces under new names, so app names are a poor way to track it.

Read the original at The Hacker News ↗