{"id":"redwing-android-spyware-fake-stores-jul-2026","category":"scam","status":"closed","title":"RedWing Android spyware uses fake app stores to steal banking logins and control phones","tldr":"RedWing tricks Android users into installing spyware and granting powerful permissions, exposing messages, banking logins and phone control. Use official app stores; if installed, remove it and secure important accounts from another device.","summary":"RedWing is Android spyware rented to criminals through Telegram and spread through phishing links and fake app-store pages. After persuading users to install it and grant permissions, it can steal SMS messages, contacts and banking or cryptocurrency credentials, stream the screen and remotely control the phone. Zimperium disclosed it on 7 July without establishing a victim count. Later, F6 estimated more than 10,000 infected devices in Russia between mid-July and mid-September. In October, F6 documented a separate data-stealing variant targeting bank customers in Russia, Uzbekistan and Kazakhstan. Infection depends on installing malicious software and granting access; the reports identify no particular Android version range or update that resolves it. Zimperium says its security products detect RedWing, but detection does not establish that an infected phone is clean. As at 3 November, the reviewed reports do not confirm a shutdown, total financial losses or recovery.","action":"Install apps through the official store app, avoid installation links in messages, and refuse unfamiliar apps access to Accessibility or SMS. If you installed a suspicious app, uninstall it and turn on scanning under Google Play Store → profile → Play Protect → Settings; ask your phone’s manufacturer for help if removal fails. From another device, change important account passwords, check banking transactions and contact your bank about suspected fraud.","product":"Android phones and tablets","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["android","redwing","spyware","phishing","banking","telegram"],"affected":["Android devices on which users install RedWing malicious applications and grant the requested permissions; no Android version range is specified in the research."],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"RedWing: A Mobile Malware-as-a-Service Operation","url":"https://zimperium.com/blog/redwing-a-mobile-malware-as-a-service-operation?hs_amp=true","by":"Zimperium","date":"2026-07-07"},{"kind":"advisory","title":"Zimperium zLabs Uncovers RedWing Mobile Malware-as-a-Service Platform Powering Full Android Device Compromise","url":"https://zimperium.com/resources/zimperium-zlabs-uncovers-redwing-mobile-malware-as-a-service-platform-powering-full-android-device-compromise?hs_amp=true","by":"Zimperium","date":"2026-07-07"},{"kind":"research","title":"F6: RedWing distributed as the RadarTrevog air-attack warning app","url":"https://www.f6.ru/media-center/press-releases/redwing/","by":"F6","date":"2026-08-12"},{"kind":"research","title":"F6: RedWing targets Russian bank customers through fake apps and videos","url":"https://www.f6.ru/media-center/press-releases/redwing-android-trojan/","by":"F6","date":"2026-09-24"},{"kind":"research","title":"F6: RedWing Stealer targets bank customers in Russia, Uzbekistan and Kazakhstan","url":"https://www.f6.ru/media-center/press-releases/redwing-stealer/","by":"F6","date":"2026-10-07"},{"kind":"news","title":"RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service","url":"https://thehackernews.com/2026/07/redwing-maas-packages-android-bank.html","by":"The Hacker News","date":"2026-07-07"},{"kind":"advisory","title":"Remove malware or unsafe software — Android phone & tablet","url":"https://support.google.com/accounts/answer/9924802?co=GENIE.Platform%3DAndroid&hl=en","by":"Google","date":""}],"started":"2026-07-07","closed":"2026-10-07","created":"2026-11-03T21:59:52.681Z","updated":"2026-11-03T21:59:52.681Z","cve_notes":[],"timeline":[{"at":"2026-10-07","added":"2026-11-03T21:54:09.841Z","kind":"wider-attacks","text":"F6 reported more than 800 RedWing Stealer samples distributed during May–September as warning apps, fuel maps, VPNs and game modifications. This variant targeted messages associated with 16 Russian, 12 Uzbekistani and seven Kazakhstani banks, alongside marketplaces and microlenders.","url":"https://www.f6.ru/media-center/press-releases/redwing-stealer/","by":"F6","patch":null},{"at":"2026-09-24","added":"2026-11-03T21:54:09.841Z","kind":"wider-attacks","text":"F6 estimated that more than 10,000 Android devices in Russia were compromised between mid-July and mid-September. It also analysed a RedWing installer disguised as an accident video, which displayed a fake Google Play update.","url":"https://www.f6.ru/media-center/press-releases/redwing-android-trojan/","by":"F6","patch":null},{"at":"2026-08-12","added":"2026-11-03T21:54:09.841Z","kind":"wider-attacks","text":"F6 reported RedWing distributed to Russian Android users as RadarTrevog, a supposed drone and missile warning app. Its fake family-safety features encouraged people to share the app with relatives.","url":"https://www.f6.ru/media-center/press-releases/redwing/","by":"F6","patch":null},{"at":"2026-07-07","added":"2026-11-03T21:54:09.841Z","kind":"disclosed","text":"Zimperium disclosed RedWing, Android spyware rented through Telegram and distributed through phishing pages impersonating app stores. It identified 82 institutions in the malware’s targeting, mainly Russian financial institutions; this was not a victim count.","url":"https://zimperium.com/blog/redwing-a-mobile-malware-as-a-service-operation?hs_amp=true","by":"Zimperium","patch":"na"}],"url":"https://hard.fyi/live/redwing-android-spyware-fake-stores-jul-2026/","json":"https://hard.fyi/api/live?id=redwing-android-spyware-fake-stores-jul-2026"}