Cybercriminals Exploit Fuel Shortage with Malicious Android Apps in Russia

Cybersecurity experts have identified a sophisticated campaign targeting Russian drivers with malicious Android applications disguised as fuel-finding services. Taking advantage of fuel availability concerns affecting several Russian regions, attackers have created phishing websites imitating gas station services and distributed malware under the guise of legitimate utility apps. Kaspersky Lab researchers found that over 1,000 users attempted to download such APK files directly from phishing sites since mid-June, bypassing official app stores — a significant indicator of broader exposure, as the actual number of potential victims may be substantially higher.

The malware campaign employs multiple deceptive tactics. One common scheme involves fake online fuel reservation services offering to sell 20 liters of petrol without queuing; users are prompted to enter SMS verification codes, which criminals then exploit to hijack Telegram accounts for further fraud or extortion. Another identified threat masquerades as a fuel-finding service called "Где бензин?" (Where is the gas?), which generates fake fuel availability data while distributing malicious APK files. Once installed, these applications request access to device location and files, enabling thieves to harvest documents, photos, videos, contacts, and personal data.

The timing of the attacks coincides with fuel access restrictions implemented across multiple Russian regions. Since late June, authorities in Crimea, Sevastopol, Adygea, Lipetsk, and Kurgan regions have imposed fuel sale limitations in response to heightened demand and supply concerns. Cybersecurity experts emphasize that attackers deliberately exploit such high-demand, high-anxiety situations to increase the likelihood of user compliance with download requests.

Security researchers from Kaspersky Lab and F6 stress the critical distinction between downloading apps from official platforms like RuStore and acquiring APK files from third-party sources. Official app stores include security vetting absent on phishing domains. The attackers capitalize on users' desire for legitimate fuel-finding tools and promise real-time information about petrol availability across the country, complete with filtering and bookmarking features — functionality that never materializes after installation. Experts recommend downloading applications exclusively from authorized vendors and exercising caution when granting file and location permissions.