Telegram‑Hosted RedWing Malware Lets Anyone Rent Android Spyware Tools, Targeting Mobile Banking Users
What Happened — Zimperium’s zLabs team discovered RedWing, an Android banking trojan offered as a subscription service through Telegram. The service provides a bot that builds custom malicious APKs, complete with documentation, tutorial videos and a referral‑discount program, allowing attackers with no coding skill to generate and distribute spyware. Infection begins with a phishing link that mimics legitimate app stores, then coerces victims into granting high‑risk permissions (battery‑optimisation bypass, default‑SMS handler, notification access) to enable credential theft, SMS interception and call‑forwarding attacks.
Why It Matters for Compliance & Audit Readiness
- The scenario exemplifies a classic access‑control failure: users are tricked into granting privileged permissions that bypass OS security controls.
- SOC 2 access‑control criteria (CC6.1, CC6.2) require documented processes for permission management, least‑privilege enforcement, and continuous monitoring of privileged actions—exactly the controls that would detect or prevent RedWing’s abuse.
- Verisq’s SOC2 Access Controls capability provides automated evidence collection on permission changes, app‑install provenance, and anomalous privilege escalation, giving you a defensible audit trail against this type of mobile‑app threat.
Who Is Affected — Financial services (mobile banking, crypto wallets), telecom operators (SMS‑based 2FA), and any organization that relies on Android devices for employee or customer interactions.
Recommended Actions
- Map the incident to SOC 2 CC6 controls (privilege management, user access reviews, monitoring of privileged actions).
- Deploy mobile‑device‑management (MDM) policies that block installation from unknown sources and enforce strict permission reviews.
- Conduct security‑awareness training focused on phishing‑linked app installations and the risks of granting system permissions.
Source: SecurityAffairs – RedWing Malware
Technical Notes
- Attack vector: Phishing link → fake app‑store page → malicious APK built via Telegram bot.
- Key permissions abused: Disable battery optimisation, set as default SMS handler, access notifications.
- Capabilities: Credential harvesting via fake login overlays, SMS interception for 2FA codes, call‑forwarding via hidden carrier code (21).
- Malware lineage: Derived from the Oblivion family, sold as “Malware‑as‑a‑Service” (MaaS).
Source: same as above