Mass attacks using LxBase RAT and RedWing have been recorded in Russia: in two months, RedWing has infected over 10,000 Android devices, while LxBase RAT is being used against Russian companies.

LxBase RAT steals crypto wallet data; access costs $119 per month

The trojan can steal passwords, cookies, bank card data, and authentication tokens from crypto wallets, browsers, email, and messengers. It is distributed through phishing emails that imitate business correspondence with companies from Kazakhstan. Access to the malware and its security bypass tool is sold for $119 per month.

RedWing intercepts PIN codes and SMS, records audio and video

RedWing infects devices via Telegram, disguised as apps and video files. It can intercept PIN codes, pattern locks, and SMS, redirect calls, and record audio and video.