A new report reveals that cybercriminals are actively exploiting widespread fuel shortages and fears of drone attacks in Russia. Their tactic involves luring users into downloading malicious Android applications designed to steal personal and financial information. ### Deceptive Apps Deliver ZloyRAT Trojan The latest campaign targets Russian drivers with an app falsely claiming to display the locations of traffic police patrols, speed cameras, and gas stations with available fuel. However, this app delivers **ZloyRAT**, an Android trojan capable of collecting sensitive information and accessing various functions on infected phones. This discovery comes from researchers at Russian cybersecurity firm **F6**. Beyond the traffic and fuel app, the malware is also being distributed through two other deceptive applications: * **GosuVPN**: Advertised as a free, government-backed service for unrestricted internet access. * **Drone Radar**: Claims to display real-time drone attacks on an interactive map. All three applications are promoted via a website registered in early October. **F6** researchers have requested that the website be blocked in Russia. This campaign unfolds against a backdrop of widespread fuel shortages and rising gasoline prices in Russia, partly exacerbated by long-range Ukrainian drone and missile strikes on Russian oil refineries. The identity of the threat actor behind this campaign remains unknown. **F6** notes that malicious applications targeting drivers are typically advertised within online communities frequented by truck drivers, taxi operators, and delivery workers. ### ZloyRAT: An Info-Stealing Powerhouse **ZloyRAT** was first identified by **F6** earlier this year. Upon installation, it masquerades as a legitimate application and requests extensive permissions, including access to text messages, contacts, and phone calls. Its capabilities include collecting incoming text messages and push notifications, as well as sending messages and making calls from compromised devices. The trojan specifically targets information associated with over 60 Russian banking and financial applications, online marketplaces, government services, and the **Telegram** messaging platform. To evade detection, **ZloyRAT** can display a legitimate website when users interact with the malicious app, making it harder for victims to realize their device has been compromised. Infected phones may also experience noticeable performance degradation. **F6** has not disclosed the number of downloads or confirmed financial losses resulting from this campaign. ### A Growing Market for Wartime Scams This campaign is part of a broader trend of cybercrime that capitalizes on Russia's wartime disruptions, particularly anxieties surrounding drone strikes and fuel availability. Earlier this year, **F6** identified another Android application called **RadarTrevog**. This app mimicked a drone warning service while distributing **RedWing Stealer**, another type of malware designed to pilfer information from infected devices. Researchers uncovered over 800 samples of **RedWing Stealer** hidden within apps advertised as drone alert services, fuel availability maps, VPNs, and other mobile utilities. Fuel shortages have also created fertile ground for online fraud. In the fall, scammers established at least 17 websites under the **FuelDrive** brand, advertising bulk fuel deliveries across Russia. Another operation, uncovered in August, used a fictitious company named **Toplivo24** to offer gasoline, diesel, and natural gas at prices up to 30 percent below market rates. In July, **F6** identified over 60 fraudulent websites, some posing as gas station maps, specifically designed to hijack **Telegram** accounts. A separate campaign offered drivers the opportunity to reserve 20 liters of gasoline in advance, ostensibly to help them avoid fuel shortages and long queues.