A new Android spyware called RedWing is being rented out through a Telegram bot, letting anyone with minimal technical skill hijack phones and steal banking credentials. The operation was uncovered by Zimperium, which highlighted how the malware is marketed as a service for cash‑strapped cybercriminals (according to their blog).
RedWing operates as a malware‑as‑a‑service offering, distributed via a Telegram channel where customers receive a malicious APK that pretends to be a legitimate app store or utility. Once installed, the spyware can intercept SMS messages, display fake overlays on banking and crypto apps, log keystrokes, give the attacker live screen control and even turn on the device's camera or microphone (as reported by Infosecurity Magazine).
No CVE identifiers have been assigned to RedWing because it does not rely on a known Android vulnerability. Instead it abuses standard permissions and social engineering to gain access (per Security Affairs).
Research from Zimperium links the operation to Russian cybercriminal groups and shows that the service has been advertised openly on Telegram since early July 2026. The malware avoids detection by many mobile antivirus products because it behaves like a normal application until the attacker activates its malicious modules.
Users should only install applications from official stores and verify the developer name before granting any permissions, especially those that request access to SMS, contacts or accessibility services. They should also be wary of unsolicited links or messages that prompt the installation of unknown apps, as these are the primary delivery method for RedWing.
Enterprises can enforce app allow‑listing on managed devices and deploy mobile threat defence solutions that monitor for unusual overlay behaviour or unauthorized access to the camera and microphone. Security teams should block known Telegram bot domains associated with the RedWing campaign at the network perimeter and share indicators of compromise with information‑sharing communities to speed up detection.