New FireScam Android data-theft malware poses as Telegram Premium app

Share:

A new Android malware named ‘FireScam’ is being distributed as a premium version of the Telegram app via phishing websites on GitHub that mimick the RuStore, Russia’s app market for mobile devices.

RuStore launched in May 2022 by the Russian internet group VK (VKontakte) as an alternative to Google Play and Apple’s App Store, following Western sanctions that impacted Russian users’ access to mobile software.

It hosts apps that are compliant with Russian regulations and it was created with the support of the Russian Ministry of Digital Development.

According to researchers at threat management company Cyfirma, the malicious GitHub page mimicking RuStore first delivers a dropper module called GetAppsRu.apk.

The dropper APK is obfuscated using DexGuard to evade detection and acquires permissions that allow it to identify installed apps, gives it access to the device’s storage, and install additional packages.

Next, it extracts and installs the main malware payload, ‘Telegram Premium.apk’, which requests permissions to monitor notifications, clipboard data, SMS, and telephony services, among others.

RuStore clone hosted on a GitHub.io domain
RuStore clone hosted on a GitHub.io domain
Source: CYFIRMA

FireScam capabilities

Upon execution, a deceptive WebView screen showing a Telegram login page steals the user’s credentials for the messaging service.

FireScam establishes communication with a Firebase Realtime Database where it uploads stolen data in real-time and registers the compromised device with unique identifiers, for tracking purposes.

Cyfirma reports that stolen data is only stored in the database temporarily and then wiped, presumably after the threat actors filtered it for valuable information and copied it to a different location.

The malware also opens a persistent WebSocket connection with the Firebase C2 endpoint for real-time command execution like requesting specific data, triggering immediate uploads to the Firebase database, downloading and executing additional payloads, or adjusting the surveillance parameters.

FireScam can also monitor changes in the screen activity, capturing on/off events and log the active app at the time as well as activity data for events lasting for more than 1,000 milliseconds.

The malware also meticulously monitors any e-commerce transactions, attempting to capture sensitive financial data.

Anything the user types, drags and drops, copies to clipboard, and intercepts even data automatically filled from password managers or exchanges between apps, categorized, and exfiltrated to the threat actors.

Data exfiltrated by FireScam
Data exfiltrated by FireScam
Source: CYFIRMA

Although Cyfirma does not have any hints pointing to FireScam’s operators, the researchers say that the malware is a “sophisticated and multifaceted threat” that “employs advanced evasion techniques.”

The company recommends users to execute caution when opening files from potentially untrusted sources or when clicking on unfamiliar links.

Source

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
8:46 am, Jul 11, 2025
weather icon 24°C
L: 22° | H: 25°
few clouds
Humidity: 61 %
Pressure: 1021 mb
Wind: 1 mph E
Wind Gust: 1 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 12%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:56 am
Sunset: 9:15 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
22° | 25°°C 0 mm 0% 8 mph 62 % 1021 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
18° | 30°°C 0 mm 0% 9 mph 65 % 1018 mb 0 mm/h
Sun Jul 13 10:00 pm
weather icon
17° | 27°°C 0 mm 0% 7 mph 73 % 1014 mb 0 mm/h
Mon Jul 14 10:00 pm
weather icon
20° | 29°°C 0 mm 0% 14 mph 71 % 1017 mb 0 mm/h
Tue Jul 15 10:00 pm
weather icon
15° | 27°°C 0 mm 0% 13 mph 71 % 1021 mb 0 mm/h
Today 10:00 am
weather icon
24° | 25°°C 0 mm 0% 3 mph 62 % 1021 mb 0 mm/h
Today 1:00 pm
weather icon
26° | 29°°C 0 mm 0% 3 mph 53 % 1021 mb 0 mm/h
Today 4:00 pm
weather icon
29° | 31°°C 0 mm 0% 5 mph 37 % 1019 mb 0 mm/h
Today 7:00 pm
weather icon
28° | 28°°C 0 mm 0% 5 mph 28 % 1017 mb 0 mm/h
Today 10:00 pm
weather icon
22° | 22°°C 0 mm 0% 8 mph 47 % 1019 mb 0 mm/h
Tomorrow 1:00 am
weather icon
18° | 18°°C 0 mm 0% 4 mph 55 % 1018 mb 0 mm/h
Tomorrow 4:00 am
weather icon
19° | 19°°C 0 mm 0% 4 mph 65 % 1018 mb 0 mm/h
Tomorrow 7:00 am
weather icon
19° | 19°°C 0 mm 0% 6 mph 64 % 1018 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€100,784.39
5.96%
Ethereum(ETH)
€2,561.90
6.74%
Tether(USDT)
€0.85
0.01%
XRP(XRP)
€2.21
6.23%
Solana(SOL)
€140.19
3.58%
USDC(USDC)
€0.85
0.01%
Dogecoin(DOGE)
€0.169283
8.80%
Shiba Inu(SHIB)
€0.000011
7.07%
Pepe(PEPE)
€0.000011
14.58%
Peanut the Squirrel(PNUT)
€0.244796
19.31%
Scroll to Top