RedWing Android spyware uses fake app stores to steal banking logins and control phones
RedWing tricks Android users into installing spyware and granting powerful permissions, exposing messages, banking logins and phone control. Use official app stores; if installed, remove it and secure important accounts from another device.
Install apps through the official store app, avoid installation links in messages, and refuse unfamiliar apps access to Accessibility or SMS. If you installed a suspicious app, uninstall it and turn on scanning under Google Play Store → profile → Play Protect → Settings; ask your phone’s manufacturer for help if removal fails. From another device, change important account passwords, check banking transactions and contact your bank about suspected fraud.
What’s happening
RedWing is Android spyware rented to criminals through Telegram and spread through phishing links and fake app-store pages. After persuading users to install it and grant permissions, it can steal SMS messages, contacts and banking or cryptocurrency credentials, stream the screen and remotely control the phone. Zimperium disclosed it on 7 July without establishing a victim count. Later, F6 estimated more than 10,000 infected devices in Russia between mid-July and mid-September. In October, F6 documented a separate data-stealing variant targeting bank customers in Russia, Uzbekistan and Kazakhstan. Infection depends on installing malicious software and granting access; the reports identify no particular Android version range or update that resolves it. Zimperium says its security products detect RedWing, but detection does not establish that an infected phone is clean. As at 3 November, the reviewed reports do not confirm a shutdown, total financial losses or recovery.
- What
- Scam
- Affects
- Android phones and tablets
- Affected
- Android devices on which users install RedWing malicious applications and grant the requested permissions; no Android version range is specified in the research.
- Fixed in
- Nothing to patch
- Since
- 7 July 2026
- Closed
- 7 Oct 2026
Timeline
- Wider attacks
F6 reported more than 800 RedWing Stealer samples distributed during May–September as warning apps, fuel maps, VPNs and game modifications. This variant targeted messages associated with 16 Russian, 12 Uzbekistani and seven Kazakhstani banks, alongside marketplaces and microlenders.
- Wider attacks
F6 estimated that more than 10,000 Android devices in Russia were compromised between mid-July and mid-September. It also analysed a RedWing installer disguised as an accident video, which displayed a fake Google Play update.
- Wider attacks
F6 reported RedWing distributed to Russian Android users as RadarTrevog, a supposed drone and missile warning app. Its fake family-safety features encouraged people to share the app with relatives.
- Made publicNothing to patch
Zimperium disclosed RedWing, Android spyware rented through Telegram and distributed through phishing pages impersonating app stores. It identified 82 institutions in the malware’s targeting, mainly Russian financial institutions; this was not a victim count.
Sources
- RedWing: A Mobile Malware-as-a-Service OperationZimperium · 7 July 2026
- Zimperium zLabs Uncovers RedWing Mobile Malware-as-a-Service Platform Powering Full Android Device CompromiseZimperium · 7 July 2026
- F6: RedWing distributed as the RadarTrevog air-attack warning appF6 · 12 Aug 2026
- F6: RedWing targets Russian bank customers through fake apps and videosF6 · 24 Sept 2026
- F6: RedWing Stealer targets bank customers in Russia, Uzbekistan and KazakhstanF6 · 7 Oct 2026
- RedWing MaaS Packages Android Bank Fraud as a Telegram Rental ServiceThe Hacker News · 7 July 2026
- Remove malware or unsafe software — Android phone & tabletGoogle