Malicious apps prey on Russians’ anxiety about fuel prices, drone strikes

Cybercriminals are exploiting fuel shortages and fears of drone attacks in Russia to trick users into downloading malicious Android apps designed to steal personal and financial information, according to a new report.

The latest campaign targets Russian drivers with an app that claims to show the locations of traffic police patrols, speed cameras and gas stations with fuel in stock. Instead, it delivers ZloyRAT, an Android trojan capable of collecting sensitive information and accessing functions on infected phones, according to researchers at Russian cybersecurity firm F6.

The malware is also being distributed through two other fake applications: GosuVPN, advertised as a free government-backed service for accessing the unrestricted internet, and Drone Radar, which claims to display drone attacks on an interactive map in real time.

All three apps are promoted through a website registered in early October, researchers said, adding that they had requested to block the website in Russia.

The campaign comes as Russia faces widespread fuel shortages and rising gasoline prices, driven in part by repeated long-range Ukrainian drone and missile strikes on Russian oil refineries. The threat actor behind the campaign also remains unknown

F6 said malicious applications targeting drivers are typically advertised in online communities for truck drivers, taxi operators and delivery workers.

Info-stealing malware

ZloyRAT was first identified by F6 earlier this year.

Once installed, it disguises itself as a legitimate app and requests permission to access text messages, contacts and phone calls. It can collect incoming text messages and push notifications, send messages and make calls from an infected device.

The trojan also targets information associated with more than 60 Russian banking and financial apps, as well as online marketplaces, government services and the Telegram messaging platform.

To conceal its activity, ZloyRAT can display a legitimate website when users interact with the malicious app, making it harder for them to recognize that their device has been compromised. Researchers said infected phones may also experience slower performance.

F6 did not disclose how many people had downloaded the apps or whether the campaign had resulted in confirmed financial losses.

A growing market for scams

The campaign is part of a broader wave of cybercrime exploiting Russia’s wartime disruptions, particularly concerns about drone strikes and fuel availability.

Earlier this year, F6 identified another Android app, called RadarTrevog, that masqueraded as a drone warning service while distributing RedWing Stealer, a type of malware designed to steal information from infected devices. Researchers discovered more than 800 samples of the malware hidden in apps advertised as drone alert services, fuel availability maps, VPNs and other mobile tools.

Fuel shortages have also created opportunities for online fraud.

In the fall, scammers set up at least 17 websites under the FuelDrive brand, advertising bulk fuel deliveries across Russia. Another operation, uncovered in August, used a fictitious company called Toplivo24 to offer gasoline, diesel and natural gas at prices up to 30 percent below market rates.

In July, F6 identified more than 60 fraudulent websites, some posing as gas station maps, designed to hijack Telegram accounts. A separate campaign offered drivers the chance to reserve 20 liters of gasoline in advance, supposedly allowing them to avoid fuel shortages and long lines.