Fake Fuel and Drone Alert Apps Spread Android Trojan Among Anxious Russian Drivers

Researchers at Russian cybersecurity firm F6 report a campaign that preys on public anxiety about fuel shortages and drone attacks. The criminals promote an app that claims to show traffic police patrols, speed cameras and petrol stations with fuel in stock. In fact it installs ZloyRAT, an Android trojan that can steal sensitive information and control functions on an infected phone. The same malware is also spread through two other fake apps: GosuVPN, billed as a free government-backed VPN, and Drone Radar, which claims to map drone attacks in real time. All three are promoted through a website registered in early October, and F6 said it has asked for the site to be blocked in Russia. The actor behind the campaign is unknown.

Once installed, ZloyRAT poses as a legitimate app and asks for access to text messages, contacts and phone calls. It can collect incoming messages and push notifications, and send messages and make calls from the device. It also targets data tied to more than 60 Russian banking and financial apps, as well as online marketplaces, government services and Telegram. To avoid suspicion, it can show a real website when the user opens the app, and infected phones may run more slowly. F6 said such apps are typically advertised in online communities for truck drivers, taxi operators and delivery workers.

F6 did not say how many people downloaded the apps or whether any financial losses were confirmed. The campaign is part of a wider wave of cybercrime exploiting wartime disruption in Russia.