How to remove RedWing Spyware from Android devices

What kind of malware is RedWing?

RedWing is a commercial spyware platform offered through a subscription model, targeting Android users. It is capable of intercepting SMS messages, harvesting financial credentials, recording audio and video, and granting attackers full remote control over infected devices. According to research published by Zimperium, the operation is linked to Russian threat actors and follows a Malware-as-a-Service (MaaS) model that enables buyers to deploy customized spyware without technical expertise.

RedWing malware overview

RedWing is offered through a tiered subscription model. Access is priced at $10 per day, $60 per week, or $200 per month, with a free one-hour trial also available and custom arrangements for longer periods. Subscribers receive a web-based control panel and an automated APK builder that generates ready-to-deploy malicious applications configured to their specifications.

The operation includes a built-in phishing infrastructure letting operators construct fake app store pages that impersonate Google Play, Samsung Galaxy Store, and AppGallery. These pages can be configured with fake ratings, review counts, and download statistics, making them appear indistinguishable from legitimate marketplace listings.

RedWing has been observed spreading through fake update prompts delivered via RuStore, a legitimate Russian mobile marketplace. The malicious application typically installs under a generic, inconspicuous name to avoid raising suspicion. Once installed, it presents the victim with a multi-step setup wizard disguised as a "system protection" configuration screen.

Through these social engineering overlays, RedWing requests a series of powerful permissions. It asks to become the device's default SMS application, gain Accessibility Service privileges, receive device administrator access, bypass battery optimization for persistent background operation, and access notifications.

Once those permissions are granted, the malware begins collecting a broad range of personal data. It steals SMS messages, call logs, and contacts, enumerates files on the device, tracks geographic location, records keystrokes, and monitors the clipboard. All collected data is transmitted to the attacker's command-and-control server.

RedWing also includes extensive remote access capabilities. Operators can stream the device screen live using a built-in VNC module, take screenshots, activate the camera to capture photos or video, and record audio through the microphone. The device can also be remotely locked at any time.

A major financial threat posed by RedWing is its overlay attack capability, targeting over 82 banking and cryptocurrency applications with a strong focus on Russian financial institutions. When a victim opens one of these targeted apps, a convincing fake login screen is placed on top to silently steal their credentials.

To defeat two-factor authentication, RedWing intercepts incoming SMS messages before the victim can read them. It can also redirect calls using USSD commands, silently forwarding them so that voice-based verification codes reach the attacker rather than the intended recipient.

Beyond surveillance, RedWing can enlist infected devices as nodes in a botnet for coordinated HTTP flood attacks against attacker-specified targets. A built-in proxy module enables network tunneling, and the malware supports over 150 individual remote commands covering everything from overlay injection to file management.

Malware developers frequently update and expand their tools. Future iterations of RedWing may carry additional or different capabilities from those documented here.

In summary, the presence of RedWing on a device can lead to complete loss of privacy, theft of banking credentials and authentication codes, unauthorized financial transactions, and full remote control of the device by a third party.

Android spyware examples

RedWing is a capable commercial spyware tool that gives subscribers extensive control over infected Android devices. Its combination of financial fraud modules, broad surveillance capabilities, and subscriber-friendly MaaS infrastructure makes it a serious threat to anyone whose device a buyer chooses to target.

Android-targeting spyware and malware take many forms. Examples of similar threats include ResidentBat, Landfall, and PlainGnome.

It is worth noting that most Android malware is created with financial gain as the primary motive, though surveillance objectives and ideological goals can also play a role. Regardless of intent, any such threat should be removed from the device as soon as it is identified.

How did RedWing infiltrate my device?

RedWing's operators use phishing sites styled to closely resemble legitimate app marketplaces such as Google Play, Samsung Galaxy Store, and AppGallery. Victims are typically directed to these pages through targeted campaigns and encouraged to download what appears to be an official app or a required update.

The malware has also spread as fake RuStore update prompts. These notifications claim an installed application needs a mandatory update to continue functioning and include false security badges to build trust. Accepting the update downloads and installs the RedWing APK onto the device.

Because the RedWing builder lets buyers customize the app name, icon, and permission flow via a Telegram bot, the malicious application's appearance can vary significantly between campaigns. Users should be suspicious of any installation prompt that appears outside the official app store itself.

How to avoid installation of malware?

Install applications only from the official Google Play Store or a developer's verified website. Avoid downloading APK files shared through Telegram, social media, SMS links, or any other unofficial channel, even if the prompt appears to come from a familiar and trusted app.

Review app permissions carefully before granting them. Legitimate applications rarely need Accessibility Service access or the right to become your default SMS handler. Keeping Android updated and running a reputable mobile security application adds a strong additional layer of protection against threats like RedWing.

RedWing spyware distributed via a fake RuStore update prompt and the Android "Install unknown apps" screen triggered during installation (source: zimperium.com):

RedWing permission setup wizard requesting SMS default app access, Accessibility Service, and device administrator privileges (source: zimperium.com):

RedWing builder-generated permission request cards prompting the victim to allow battery optimization bypass, SMS access, and notification access (source: zimperium.com):

Quick menu:

• Introduction
• How to delete browsing history from the Chrome web browser?
• How to disable browser notifications in the Chrome web browser?
• How to reset the Chrome web browser?
• How to delete browsing history from the Firefox web browser?
• How to disable browser notifications in the Firefox web browser?
• How to reset the Firefox web browser?
• How to uninstall potentially unwanted and/or malicious applications?
• How to boot the Android device in "Safe Mode"?
• How to check the battery usage of various applications?
• How to check the data usage of various applications?
• How to install the latest software updates?
• How to reset the system to its default state?
• How to disable applications that have administrator privileges?

Delete browsing history from the Chrome web browser:

Tap the "Menu" button (three dots on the right-upper corner of the screen) and select "History" in the opened dropdown menu.

Tap "Clear browsing data", select "ADVANCED" tab, choose the time range and data types you want to delete and tap "Clear data".

[Back to Table of Contents]

Disable browser notifications in the Chrome web browser:

Tap the "Menu" button (three dots on the right-upper corner of the screen) and select "Settings" in the opened dropdown menu.

Scroll down until you see "Site settings" option and tap it. Scroll down until you see "Notifications" option and tap it.

Find the websites that deliver browser notifications, tap on them and click "Clear & reset". This will remove permissions granted for these websites to deliver notifications. However, once you visit the same site again, it may ask for a permission again. You can choose whether to give these permissions or not (if you choose to decline the website will go to "Blocked" section and will no longer ask you for the permission).

[Back to Table of Contents]

Reset the Chrome web browser:

Go to "Settings", scroll down until you see "Apps" and tap it.

Scroll down until you find "Chrome" application, select it and tap "Storage" option.

Tap "MANAGE STORAGE", then "CLEAR ALL DATA" and confirm the action by taping "OK". Note that resetting the browser will eliminate all data stored within. This means that all saved logins/passwords, browsing history, non-default settings and other data will be deleted. You will also have to re-login into all websites as well.

[Back to Table of Contents]

Delete browsing history from the Firefox web browser:

Tap the "Menu" button (three dots on the right-upper corner of the screen) and select "History" in the opened dropdown menu.

Scroll down until you see "Clear private data" and tap it. Select data types you want to remove and tap "CLEAR DATA".

[Back to Table of Contents]

Disable browser notifications in the Firefox web browser:

Visit the website that is delivering browser notifications, tap the icon displayed on the left of URL bar (the icon will not necessarily be a "Lock") and select "Edit Site Settings".

In the opened pop-up opt-in the "Notifications" option and tap "CLEAR".

[Back to Table of Contents]

Reset the Firefox web browser:

Go to "Settings", scroll down until you see "Apps" and tap it.

Scroll down until you find "Firefox" application, select it and tap "Storage" option.

Tap "CLEAR DATA" and confirm the action by taping "DELETE". Note that resetting the browser will eliminate all data stored within. This means that all saved logins/passwords, browsing history, non-default settings and other data will be deleted. You will also have to re-login into all websites as well.

[Back to Table of Contents]

Uninstall potentially unwanted and/or malicious applications:

Go to "Settings", scroll down until you see "Apps" and tap it.

Scroll down until you see a potentially unwanted and/or malicious application, select it and tap "Uninstall". If, for some reason, you are unable to remove the selected app (e.g., you are prompted with an error message), you should try using the "Safe Mode".

[Back to Table of Contents]

Boot the Android device in "Safe Mode":

The "Safe Mode" in Android operating system temporarily disables all third-party applications from running. Using this mode is a good way to diagnose and solve various issues (e.g., remove malicious applications that prevent users you from doing so when the device is running "normally").

Push the "Power" button and hold it until you see the "Power off" screen. Tap the "Power off" icon and hold it. After a few seconds the "Safe Mode" option will appear and you'll be able run it by restarting the device.

[Back to Table of Contents]

Check the battery usage of various applications:

Go to "Settings", scroll down until you see "Device maintenance" and tap it.

Tap "Battery" and check the usage of each application. Legitimate/genuine applications are designed to use as low energy as possible in order to provide the best user experience and to save power. Therefore, high battery usage may indicate that the application is malicious.

[Back to Table of Contents]

Check the data usage of various applications:

Go to "Settings", scroll down until you see "Connections" and tap it.

Scroll down until you see "Data usage" and select this option. As with battery, legitimate/genuine applications are designed to minimize data usage as much as possible. This means that huge data usage may indicate presence of malicious application. Note that some malicious applications might be designed to operate when the device is connected to wireless network only. For this reason, you should check both Mobile and Wi-Fi data usage.

If you find an application that uses a lot of data even though you never use it, then we strongly advise you to uninstall it as soon as possible.

[Back to Table of Contents]

Install the latest software updates:

Keeping the software up-to-date is a good practice when it comes to device safety. The device manufacturers are continually releasing various security patches and Android updates in order to fix errors and bugs that can be abused by cybercriminals. An outdated system is way more vulnerable, which is why you should always be sure that your device's software is up-to-date.

Go to "Settings", scroll down until you see "Software update" and tap it.

Tap "Download updates manually" and check if there are any updates available. If so, install them immediately. We also recommend to enable the "Download updates automatically" option - it will enable the system to notify you once an update is released and/or install it automatically.

[Back to Table of Contents]

Reset the system to its default state:

Performing a "Factory Reset" is a good way to remove all unwanted applications, restore system's settings to default and clean the device in general. However, you must keep in mind that all data within the device will be deleted, including photos, video/audio files, phone numbers (stored within the device, not the SIM card), SMS messages, and so forth. In other words, the device will be restored to its primal state.

You can also restore the basic system settings and/or simply network settings as well.

Go to "Settings", scroll down until you see "About phone" and tap it.

Scroll down until you see "Reset" and tap it. Now choose the action you want to perform:
"Reset settings" - restore all system settings to default;
"Reset network settings" - restore all network-related settings to default;
"Factory data reset" - reset the entire system and completely delete all stored data;

[Back to Table of Contents]

Disable applications that have administrator privileges:

If a malicious application gets administrator-level privileges it can seriously damage the system. To keep the device as safe as possible you should always check what apps have such privileges and disable the ones that shouldn't.

Go to "Settings", scroll down until you see "Lock screen and security" and tap it.

Scroll down until you see "Other security settings", tap it and then tap "Device admin apps".

Identify applications that should not have administrator privileges, tap them and then tap "DEACTIVATE".

Frequently Asked Questions (FAQ)

My Android device is infected with RedWing malware, should I format my storage device to get rid of it?

Formatting is rarely required for malware removal. Running a reputable mobile antivirus solution such as Combo Cleaner should be sufficient to detect and eliminate RedWing from your device without resorting to a full factory reset.

What are the biggest issues that RedWing malware can cause?

RedWing grants attackers near-total control over an infected device. They can intercept SMS messages including two-factor authentication codes, steal banking credentials through fake overlay screens, and access the camera and microphone without the victim's knowledge.

Beyond surveillance, operators can redirect incoming calls to bypass phone-based authentication, remotely lock the device, and coordinate multiple infected phones to launch traffic flood attacks. Serious financial losses and identity theft are among the most likely real-world outcomes.

What is the purpose of RedWing malware?

RedWing is primarily profit-driven. The MaaS model allows subscribers to pay for access and use the toolkit to steal banking credentials, harvest two-factor authentication codes, conduct unauthorized surveillance, and commit financial fraud.

Given the malware's heavy focus on Russian financial applications and its apparent ties to Russian-speaking threat actors, motivations beyond financial gain - such as state-aligned intelligence gathering - cannot be ruled out.

How did RedWing malware infiltrate my Android device?

RedWing most commonly arrives through phishing sites impersonating legitimate app stores such as Google Play or RuStore, where victims are prompted to download a fake update. Subscription buyers generate customized APKs through a Telegram bot and distribute them via phishing links or messaging platforms.

Will Combo Cleaner protect me from malware?

Combo Cleaner can detect and remove the vast majority of known malware infections. Performing a full device scan is particularly important for threats like RedWing, which embed themselves deeply through accessibility privileges and device administrator rights.