Inside the RedWing Malware Rental Service

According to a recent report from The Hacker News, security researchers have uncovered a new Android malware operation called RedWing that is being rented out on Telegram like a subscription software service. This development matters because it shows how easy it has become for criminals to target banking apps without needing any coding skills.

The service provides a complete toolkit that includes fake app store pages, permission-hijacking techniques, and the ability to steal login details and one-time codes. What makes this particularly worrying is that the malware can take over a victim's phone by abusing Android's accessibility features, allowing attackers to read screens, intercept messages, and even forward calls to themselves.

Why the Rental Model Changes Everything for Cyber Threats

This "malware-as-a-service" approach removes the technical barrier that once kept many would-be attackers out. Instead of having to write their own code, criminals can simply pay a monthly fee and receive a custom-built app targeting specific banks. The rental model means the creators can constantly update the tool, fix bugs, and add new capabilities while their customers focus only on spreading the malicious links.

The targeting flexibility is also a red flag. These kits allow buyers to change which financial institutions to attack after the malware is already in the wild. That means a fraud operation that started targeting Russian banks could be quickly repurposed to go after Australian credit unions or business accounts. The infrastructure is already built; all that changes is the list of target apps.

What This Means for Australian SMBs

Small and mid-sized businesses in Australia are attractive targets because they often lack dedicated cybersecurity teams. Employees who use personal Android phones for work tasks — checking emails, approving payments, logging into company banking portals — are now potential entry points. If a staff member installs a malicious app disguised as a utility or game, the attacker can silently steal business banking credentials and bypass two-factor authentication.

The risk is especially high for businesses that rely on mobile banking apps or that give employees access to financial systems from unmanaged devices. Even if your company uses strong cloud security, a compromised phone can offer attackers a direct, unfiltered view of your most sensitive accounts.

What You Can Do Now

  • Educate every employee to never install apps from outside the official Google Play Store, and to treat any unsolicited link or text message that asks them to install an "update" with extreme suspicion.
  • Enforce a company policy that bans sideloading on any device used for work, and consider using mobile device management (MDM) software to block installation from unknown sources automatically.
  • Remind staff to deny any app request for Android's Accessibility service, default SMS handler, or battery optimization exemption unless the app has an obvious, legitimate reason to need it.
  • Regularly audit which apps have been granted permission to read notifications or overlay other apps, and remove any that seem suspicious or unnecessary.
  • Set up a clear incident response plan so that if an employee reports unusual phone behaviour — like an app hiding its icon or unexpected call forwarding — the business banking accounts can be locked down immediately.

At MS&VG, we help Australian SMBs stay ahead of fast-moving threats like the RedWing toolkit by providing practical cybersecurity guidance tailored to local business needs. Contact us to discuss how to strengthen your mobile device security without overwhelming your team.