Cybersecurity analysts at F6 have discovered hackers distributing the RedWing Android trojan disguised as a drone alert application called RadarTrevog. The malicious software is presented as an official service providing real-time warnings about unmanned aerial vehicle attacks and missile threats.
F6 told Lenta.ru that cybercriminals are setting up phishing portals built on a shared template to trick users into downloading the malware. The fake websites promise prompt local warnings even under weak mobile signal conditions, loud sirens when devices are set to silent mode, and simultaneous tracking of multiple locations including homes, workplaces, cottages, and relatives' residences.
To appear legitimate, the scam portals claim to pull information directly from regional notification systems, operational headquarters, and local departments of the Ministry of Emergency Situations. However, downloads from these sites install the RedWing trojan, which has circulated in specialized Telegram communities since at least early 2026.
Capabilities of the RedWing Trojan
F6 analysts warned that RedWing allows attackers to steal sensitive data from infected devices, including text messages, contact lists, call logs, and personal files. The trojan can also harvest credentials for online banking and cryptocurrency services, spy on user activities, steal funds, and hijack messaging app accounts.
The malware enables attackers to remotely control smartphones in real time by monitoring screen activity, hide its presence from security detection, and enlist compromised devices into distributed denial of service attacks. While authorities have blocked both domains identified by experts, analysts noted that fraudsters could easily launch identical websites.
The alert app scheme follows a broader trend of online fraud in Russia. Specialists previously discovered approximately 300 fake websites created using artificial intelligence to sell tickets for non-existent water parks and amusement parks.
