In short: On 1 August 2026 Russia's Interior Ministry (MVD) warned of a new scam: fake apps that pose as gas-station finders and maps. Found through ordinary search engines rather than official stores, they install malware once opened. That malware gives attackers remote access to the phone — enough to read personal data and drain money. The fix is mostly about how you install apps, and below is a short routine to shut this down.
What happened
According to the MVD advisory, reported by TASS, criminals are spreading applications that claim to show the location of fuel stations. A user searching for a handy gas-station map finds one of these apps, installs it, and unknowingly loads malicious software onto the device. From there the attacker can control the gadget remotely, reach the personal data stored on it and steal funds. The ministry's core recommendation is blunt: install apps only from official app stores.
The pattern is familiar. A useful-looking tool is really a delivery vehicle for a remote-access trojan — the same mechanism behind the wave of Android banking trojans targeting Russian users. The lure changes — a delivery app, a bank clone, now a gas-station map — but the payload and the goal stay the same.
What the malware actually does
Once installed and granted permissions, this class of app does not just show ads. Remote-access malware can read what is on the phone and act on the owner's behalf. In practice that means it can harvest contacts, messages and stored credentials, intercept one-time SMS codes used to confirm bank transfers, and quietly operate in the background while the fake map still works on screen. Because the code was never reviewed by an app store, nothing warns you that a fuel-finder is also reading your texts.
The dangerous permissions are the tell. An app that only needs your location to show nearby stations has no honest reason to request access to SMS, accessibility services, device administration or the ability to install other apps. Those are the powers a remote-control trojan needs — and the ones a genuine map never asks for.
Why apps from outside the store are the risk
The single decision that matters here is where the app comes from. Official stores scan submissions and can pull a malicious app after the fact; a file downloaded from a search result or a random site has passed no such check. Sideloading — installing from outside the official store — removes the one safety net most users rely on. That is why the MVD's advice reduces to a habit rather than a product: treat any app you had to find through a search engine, a messenger link or an unfamiliar site as untrusted until proven otherwise.
What it means for an ordinary user
You do not need to do anything exotic to be exposed — just search for a common utility and install the first convincing result. The victims here are ordinary drivers looking for cheaper fuel, not targets of a sophisticated attack. The good news is that the defence is equally ordinary: a few install-time habits stop almost all of it, because the whole scheme depends on you placing the app on your phone yourself.
How to protect your data
Install only from official stores. Use the App Store or Google Play, and ignore fuel-map apps offered through search ads, messenger links or unofficial sites. If an app is not in the official store, treat that as a red flag, not an inconvenience.
Read the permissions. A gas-station map needs location — nothing more. Deny requests for SMS, accessibility, device-admin or install-apps rights, and remove any app that insists on them.
Keep the phone updated and scan it. System and security updates close the holes this malware leans on; a reputable mobile security app can flag a trojan you already installed.
Harden money and accounts. Use unique passwords with a manager and two-factor authentication, and be wary of any app or message that asks you to read out an SMS code.
Hide your traffic on untrusted networks. A no-logs VPN encrypts your connection and replaces your real IP with a server address, so the network you are on cannot see which sites you visit or read your traffic. Be clear on the honest limit: a VPN does not stop a trojan you installed yourself — that is what the install-time habits above are for. It protects the connection, not a device you have already handed control of. Use it as one layer, alongside store-only installs and permission hygiene. LiMP VPN is a no-logs service for iOS and Android — see the plans, and follow more privacy news on our blog.
Sources
Based on the Interior Ministry advisory of 1 August 2026 as reported by Izvestia (citing TASS) and by the Gorod-network regional outlets, which independently covered the same warning.