This nasty Android malware is posing as the Telegram Premium app
Share:
Victims targeted with dangerous infostealing malware posing as Telegram. When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works. Experts have detected a new piece of information-stealing malware posing as one of the most popular messaging apps around.
![[Ransomware]](https://vanilla.futurecdn.net/cyclingnews/media/img/missing-image.svg)
Cybersecurity researchers from CyFirma recently discovered an Android app, pretending to be a premium version of Telegram, but which actually steals victim’s login credentials and sensitive information. The researchers explained how back in 2022, when the Russian invasion of Ukraine began, the West imposed heavy sanctions on Putin’s regime. These sanctions meant Russians could not access Google's Play Store or Apple’s App Store. To provide Russian citizens with access to mobile software, the country’s Ministry of Digital Development, together with VK (the country’s social media behemoth and essentially a Facebook clone) created RuStore, a mobile app marketplace.
Cyfirma now claims someone created phishing websites on GitHub designed to look like RuStore. Victims that visit the website will first get a dropper module named GetAppsRu.apk, which lists apps installed on the device, gains access to device storage, and installs additional packages.
Among the additional packages is the main malware, called Telegram Premium.apk. This malware, dubbed FireScam, requests permissions to monitor notifications, clipboard data, SMS, and more. It also displays a fake Telegram login page to steal the credentials.
