FireScam Malware Lures Victims By Posing As Telegram Premium

Researchers have discovered a new threat that is actively targeting Android users. Known as FireScam, this Android malware primarily focuses on Russian users by masquerading as Telegram Premium.

FireScam Android Malware Distributed Through Fake RuStore App

A recent report from cybersecurity firm Cyfirma reveals that a new Android malware, FireScam, is circulating among Russian users. This malware possesses all the necessary malicious capabilities to be a significant threat, including evading security measures, maintaining persistence on infected devices, and stealing data.

FireScam is spread through phishing websites that deceive victims. It is predominantly distributed through a fake RuStore app, which is a phishing site hosted on GitHub.io. By using the name of a legitimate app (RuStore), the malware tricks users into downloading it under the guise of Telegram Premium.

When the malicious app is downloaded, it installs a malware dropper APK that then downloads and installs the FireScam payload. Once on a device, the malware establishes persistent access and carries out various malicious activities, such as stealing messages, notifications, and other data, monitoring screen changes, transactions, and clipboard activity, and using obfuscation techniques to avoid detection. It also has capabilities to detect emulators and virtual environments.

These functionalities make FireScam resemble spyware. It initially sends stolen information to a Firebase Realtime Database endpoint, which is then filtered and moved to a private storage.

FireScam targets a wide range of users, infecting devices running Android 8 to Android 15.

The researchers have provided a detailed technical analysis of FireScam in their report.

Given that phishing is used to distribute this malware, it is crucial for users to be cautious of the websites they visit. Avoiding interactions with unsolicited emails, messages, and random URLs can help prevent such threats.

We welcome your thoughts and comments below.