Zimperium zLabs Uncovers RedWing Mobile Malware-as-a-Service Platform Powering Full Android Device Compromise

News Highlights

• Zimperium zLabs researchers uncovered RedWing, a commercial Android Malware-as-a-Service (MaaS) platform marketed through Telegram.
• RedWing enables full mobile device compromise through remote control, credential theft, SMS interception, surveillance, and banking fraud.
• Zimperium's discovery reflects the continued evolution of mobile threats from standalone malware to commercial attack platforms available to virtually any cybercriminal.

DALLAS – July 7, 2026 – Zimperium, the world leader in AI-Empowered mobile security, today announced new research from zLabs detailing RedWing, a sophisticated Android Malware-as-a-Service (MaaS) platform that enables cybercriminals to deploy highly customizable mobile malware through a commercial subscription model. Marketed through Telegram and distributed through mobile-targeted phishing (mishing) campaigns, RedWing combines advanced remote access, credential theft, surveillance, and banking fraud capabilities into a turnkey platform that significantly lowers the barrier to launching sophisticated mobile attacks.

Unlike traditional Android malware operated by a single threat actor, RedWing provides subscribers with malware builders, phishing infrastructure, customizable payloads, and remote administration tools, allowing attackers with limited technical expertise to deploy advanced mobile campaigns at scale.

“Malware-as-a-Service has fundamentally changed the economics of cybercrime by making sophisticated mobile attack capabilities commercially available,” said Kern Smith, Vice President of Global Solutions, Zimperium. “RedWing demonstrates how today's threat actors can rent a complete attack platform capable of full device compromise, real-time surveillance, and enterprise credential theft, including the ability to intercept or bypass multi-factor authentication, all with little technical expertise. Organizations can no longer afford to treat mobile as a secondary risk. It has become one of the most vulnerable enterprise attack surfaces, with every compromised device representing a potential entry point into the corporate environment.”

According to the zLabs research, RedWing allows attackers to:

• Gain full remote control of infected Android devices through live screen streaming and virtual device interaction.
• Steal banking and cryptocurrency credentials using phishing overlays, SMS interception, and multi-factor authentication bypass techniques.
• Exfiltrate sensitive data, including contacts, messages, files, photos, and device information.
• Abuse legitimate Android services to maintain persistence, evade detection, and support additional malicious activities, including DDoS attacks.
  

Zimperium's Mobile Threat Defense (MTD) detects RedWing using on-device AI-Empowered behavioral detection that identifies malicious activity without relying on cloud lookups or known malware signatures. Combined with Mobile Application Protection Suite (MAPS), including Web Content Filtering and fraud detection capabilities, organizations can help prevent phishing, credential theft, and device compromise before sensitive data is exposed.

For the complete technical analysis, including indicators of compromise (IOCs), MITRE ATT&CK mappings, and detailed malware analysis, visit the Zimperium zLabs blog.

About Zimperium

Zimperium is the world leader in AI-Empowered mobile security. Purpose-built for mobile, Zimperium provides unparalleled protection for mobile applications and devices, leveraging the power of AI to deliver autonomous mobile security that counters evolving threats including mobile phishing (mishing), malware, app vulnerabilities, app tampering, device compromise, and even zero-day attacks. Cybercriminals have adopted a mobile-first attack strategy, targeting your most vulnerable attack surface - the mobile apps and devices that your organization and customers depend upon. Headquartered in Dallas, Texas, Zimperium is backed by Liberty Strategic Capital and SoftBank. Learn more at www.zimperium.com and connect on LinkedIn and X (@Zimperium).

Media Contact

media@zimperium.com