{"id":127638,"date":"2025-08-25T23:35:48","date_gmt":"2025-08-25T18:05:48","guid":{"rendered":"https:\/\/www.techworm.net\/?p=127638"},"modified":"2025-08-25T23:35:48","modified_gmt":"2025-08-25T18:05:48","slug":"android-malware-as-fsb-antivirus-to-spy-on-russian-businesses","status":"publish","type":"post","link":"https:\/\/www.techworm.net\/2025\/08\/android-malware-as-fsb-antivirus-to-spy-on-russian-businesses.html","title":{"rendered":"Android Malware Poses as Antivirus to Spy on Russian Businesses"},"content":{"rendered":"

A newly discovered Android spyware campaign is targeting Russian business executives, disguised as an antivirus app allegedly linked to the country\u2019s intelligence services, according to Russian cybersecurity firm Doctor Web<\/em>.<\/p>\n

The malware, tracked as Android.Backdoor.916.origin, has been active since January 2025 and has evolved through multiple versions. Its biggest threat lies in the fact that it hides behind the mask of an official-looking security app, supposedly from Russian authorities, luring Russian business executives and employees into targeted attacks.<\/p>\n

Researchers say the backdoor is capable of secretly recording video through the camera, logging keystrokes, tracking locations, stealing files, and even pulling data from popular apps like Telegram and WhatsApp, as well as browsers such as Gmail, Chrome, and Yandex.<\/p>\n

Disguised As \u201cOfficial\u201d Security Tools<\/strong><\/p>\n

The malicious app is being distributed through direct messages in chat apps, with victims receiving a download link in messenger apps, leading to a fake antivirus called \u201cGuardCB\u201d. This fake antivirus features an icon resembling the emblem of the Central Bank of the Russian Federation to add credibility.<\/p>\n

Other variants use names such as “SECURITY_FSB” or\u00a0simply \u201cFSB\u201d \u2014 suggesting a connection to Russia\u2019s Federal Security Service. The interface is available only in Russian, underscoring the highly targeted nature of the campaign.<\/p>\n

“At the same time, its interface provides only one language – Russian. That is, the malicious program is entirely focused on Russian users,”\u00a0wrote<\/a> Doctor Web researchers in a blog post.<\/p>\n

“This is confirmed by other detected modifications with file names such as “SECURITY_FSB”, “FSB” and others, which cybercriminals are trying to pass off as security programs allegedly related to Russian law enforcement agencies.”<\/p>\n

How It Works<\/strong><\/p>\n

The fake antivirus imitates genuine security software tools to avoid removal by running simulated scans. Roughly 30% of the time, it displays false positives, randomly ranging between 1 and 3 non-existent threats.<\/p>\n

Once installed, the app requests extensive permissions, including access to the microphone, camera, SMS, contacts, media files, call history, geolocation, and even Android\u2019s Accessibility Service.<\/p>\n

It then simulates fake antivirus \u201cscans,\u201d randomly reporting one to three \u201cthreats\u201d to convince users it is legitimate. However, in the background, it quietly connects to a command-and-control (C2) server, enabling attackers to:<\/p>\n