RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service

A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill criminals take over a victim's phone, steal their banking logins, and capture the one-time codes that protect their accounts. Zimperium's zLabs, which found the operation, says it looks like a new variant of Oblivion, a $300-a-month rent-a-malware tool

The report describes RedWing as a Telegram-rented Android malware-as-a-service kit that enables bank fraud by stealing banking logins, intercepting one-time codes, forwarding calls, and abusing Android permissions to take control of devices.[1][4] Zimperium says the package is sold as a ready-made product with subscription tiers, guides, and videos, lowering the skill needed for criminal use.[1][4] RealGround analysis: this is best classified as malicious AI use only if AI-enabled automation is being used to scale or operationalize the abuse; otherwise it is primarily mobile malware fraud. The main security implication is increased attack efficiency against banking customers and stronger pressure on organizations to harden mobile-channel authentication, monitor for sideloading and overlay abuse, and test defenses against credential theft and OTP interception.