RedWing Android Spyware Sold as a Service on Telegram

Zimperium's zLabs has observed a commercially operated Android spyware strain named RedWing being marketed via Telegram as a malware-as-a-service. RedWing combines credential-harvesting overlays targeting banking and crypto apps, SMS interception and call forwarding to bypass 2FA, remote VNC control, keylogging, camera/microphone capture and DDoS capabilities; operators use obfuscated APK generation, fake app-store pages, and tutorials to enable low-skilled attackers. Researchers link it to Russian actors and note it currently evades many conventional security tools.