Malicious Android Apps Exploit Russian Anxieties Over Fuel Prices and Drone Strikes
Cybercriminals are distributing infostealer malware disguised as apps that track fuel prices, police activity, and drone strikes, exploiting current events to steal sensitive information from Russians.
Cybercriminals are actively exploiting widespread anxieties in Russia concerning fuel shortages and fears of drone attacks to distribute malicious Android applications. These apps, disguised as legitimate tools, are designed to steal sensitive personal and financial information from unsuspecting users.
The latest campaign targets Russian drivers with an application that falsely claims to display the locations of traffic police patrols, speed cameras, and available fuel at gas stations. Instead of providing useful information, the app delivers ZloyRAT, an Android trojan capable of exfiltrating sensitive data and compromising various functions on infected phones, according to researchers at Russian cybersecurity firm F6. This malware is also being spread through two other deceptive applications: GosuVPN, marketed as a free government-backed service for accessing the unrestricted internet, and Drone Radar, which purports to show real-time drone attacks on an interactive map.
All three malicious applications are being promoted via a website registered in early October. Researchers have reportedly requested the blocking of this website within Russia. The timing of this campaign coincides with significant fuel shortages and rising gasoline prices across Russia, exacerbated by repeated long-range Ukrainian drone and missile strikes on Russian oil refineries. The identity of the threat actor behind this operation remains unknown.
Malicious applications targeting drivers are often advertised within online communities frequented by truck drivers, taxi operators, and delivery workers. ZloyRAT, the info-stealing malware employed in this campaign, was first identified by F6 earlier this year. Once installed, it masquerades as a legitimate application and requests extensive permissions, including access to text messages, contacts, and phone calls. It possesses the capability to collect incoming text messages and push notifications, and can even send messages and initiate calls from an infected device.
Furthermore, the trojan specifically targets information associated with over 60 Russian banking and financial applications, as well as popular online marketplaces, government services, and the Telegram messaging platform. To evade detection and conceal its malicious activities, ZloyRAT can display a legitimate website interface when users interact with the compromised app, making it more difficult for victims to realize their device has been compromised. Infected phones may also exhibit a noticeable decrease in performance.
This campaign is part of a broader trend of cybercrime leveraging Russia's wartime disruptions, particularly concerns surrounding drone strikes and fuel availability. Earlier this year, F6 identified another Android app, RadarTrevog, which posed as a drone warning service while distributing RedWing Stealer, a malware variant designed for information theft. Researchers have uncovered more than 800 samples of such malware hidden within apps advertised as drone alert services, fuel availability maps, VPNs, and other utility tools.
Fuel shortages have also created fertile ground for online fraud. In the fall, scammers established at least 17 websites under the FuelDrive brand, falsely advertising bulk fuel deliveries across Russia. Another operation, uncovered in August, utilized a fictitious company named Toplivo24 to offer gasoline, diesel, and natural gas at prices significantly below market rates. In July, F6 identified over 60 fraudulent websites, some mimicking gas station maps, specifically designed to hijack Telegram accounts. A separate campaign enticed drivers with the promise of reserving 20 liters of gasoline in advance, supposedly to help them avoid fuel shortages and long queues.