RedWing A Mobile Malware-as-a-Service Operation

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://zimperium.com/blog/redwing-a-mobile-malware-as-a-service-operation
• Blog Title: RedWing: A Mobile Malware-as-a-Service Operation
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Accessibility Services Abuse / Android Malware Post-Exploitation; also relevant to Mobile Phishing Malicious Apps and WebView Attacks

🎯 Content Summary

Overview

RedWing is an Android spyware/RAT offered as Malware-as-a-Service (MaaS) through Telegram, with suspected links to Russian-speaking threat actors. The post does not describe a CVE or memory-corruption vulnerability; instead, it documents a commercial Android malware platform that chains social engineering with abuse of legitimate Android capabilities: Accessibility Services, overlay permission, Defaul...

🔧 Technical Details

Fake mobile app-store dropper generation: A mobile malware operator can increase sideload success by creating phishing landing pages that imitate trusted stores such as Google Play, Galaxy Store, AppGallery, or RuStore. The lure becomes more convincing when the operator controls fake ratings, review counts, download numbers, developer names, localized banners, and update prompts. The victim is then socially engineered into installing an APK outside the trusted store flow.

Permission onboarding with WebView and staged cards: A malicious Android app can show a benign WebView in the background while sequential bottom-sheet cards request high-impact permissions. This makes the permission process look like normal onboarding while pushing the victim to disable battery optimization, make the app the Default SMS handler, enable Notification access, and grant Accessibility. The malware can then report permission state to C2 so the backend only sends co...

🤖 Agent Actions

Non-final status update:

I rechecked continuity from the current state.

Still confirmed:

• exactly one modified file
  • src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md
• key RedWing additions are still present:
  • RedWing reference
  • staged permission-onboarding section
  • permission bitmap / capability-gating
  • call-forwarding *21*<number>#
  • proper ending banner

No new issue appeared since the last sanity pass.

I am still not providing the final answer yet, per your instruction.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://zimperium.com/blog/redwing-a-mobile-malware-as-a-service-operation

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Accessibility Services Abuse / Android Malware Post-Exploitation; also relevant to Mobile Phishing Malicious Apps and WebView Attacks".

Repository Maintenance:

• MD Files Formatting: 981 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0