- Статьи
- Internet and technology
- Catch the moment: how scammers use the removal of Russian apps from Google Play and the App Store
Catch the moment: how scammers use the removal of Russian apps from Google Play and the App Store
The Maks messenger and VK apps have recently disappeared from the Google Play store. Earlier, in June, they were removed from the Apple App Store. Fraudsters can take advantage of this situation, as it creates an ideal backdrop for users' anxiety and uncertainty, experts have warned about this. For more information about how scammers use the removal of Russian applications from Google Play and the App Store, what are the dangers of such tricks and how to protect yourself from them, read the Izvestia article.
What is known about the removal of Russian applications
The Maks messenger and VK apps have disappeared from the Google Play store. The Russian company explained that users of Max and other VK products on Android devices will continue to receive push notifications about messages, events and calls. The official representative of the Russian Foreign Ministry, Maria Zakharova, in an interview with Izvestia, called the removal of Russian applications a classic of Western censorship.
Against this background, VK recommended switching from the .com domain to .ru on the VKontakte social network. The company clarified that the transition will not affect the functionality of the service. Users will have access to all the usual features of the social network, and the changes will only affect the website address. Later, VKontakte added that it was finally completing the transition to the domain. vk.ru .
Earlier, on June 25, Apple unilaterally and without warning removed VK applications from the App Store. They have become unavailable for downloading and updating, and users have stopped receiving push notifications. Dmitry Peskov, the press secretary of the President of Russia, questioned the reliability of the company after Apple's actions. The Ministry of Finance of the Russian Federation, in turn, called the removal of VK applications a politically motivated decision.
Why is the removal of Russian applications interesting to scammers
Attackers willingly use high-profile information channels that affect a large number of users. The removal of popular applications from official stores is one such example, Dmitry Galov, head of Kaspersky GReAT in Russia, says in an interview with Izvestia. When an application disappears from the stores, users start looking for alternative ways to install it.
"This is exactly what scammers use, offering services that supposedly help install a familiar application or restore access to it," says the expert. — However, in reality, such offers can lead to phishing sites or be used to distribute malware.
The information about the removal of applications creates an ideal background for anxiety and uncertainty — fraudsters are attracted by the very fact of access restrictions, Maxim Alexandrov, an expert in software products at the Security Code company, adds. Attackers use this opportunity to substitute the official source of downloading programs. In particular, they launch phishing app stores that visually copy the official Google Play and AppStore sites, but at the same time offer to download "exclusive" versions of deleted programs that allegedly no longer exist in legal stores. In fact, the user downloads malicious software, warns the Izvestia interlocutor.
What schemes on the topic of deleting applications should we expect in the summer of 2026
In terms of fraudulent schemes on the topic of deleting Russian applications in 2026, the focus will shift to maximum plausibility, says Nikolai Dolgov, an expert on cybersecurity at Angara Security, in an interview with Izvestia. Even today, experts see that scammers are not just distributing APK files, but building a full-fledged "ecosystem of trust" around it.
— These are clone sites with "official instructions" for installation, — says the expert. — The user is explained step by step how to enable installation from unknown sources, how to grant permissions, and how to "update certificates." In fact, a Trojan is being installed.
In addition, according to the expert, it is possible to distribute the VPO through social networks and messengers under various pretexts — "the current version of the application", "working assembly", "latest release". Such messages can even come from compromised accounts of friends. Another risk is schemes with fake updates. The user receives a notification supposedly from the service: "install the new version to continue working." And then there is a link to the malicious file.
"We predict a wave of fraudulent push notification refund services (not via web functionality) on the iPhone, as well as offers to install remote applications via remote access or third—party APK files on Android," Maxim Fedosenko, a leading analyst at the Gazinformservice Cybersecurity Analytical Center, adds.
In his opinion, the attackers, as before, will actively mimic support services and official representatives, tricking users into installing malicious files or configuration profiles under the guise of security certificates.
What schemes have you encountered before on the topic of remote applications?
Meanwhile, online scammers have tried to speculate on the topic of removing Russian applications from Google Play and the App Store before. According to Maria Sinitsina, a senior analyst at Digital Risk Protection F6, hackers have been developing similar schemes for several years now, after they started deleting banking applications.
— We often came across fake applications from banks, for example, in the App Store, which hid viral software, — says the interlocutor of Izvestia. — Scammers also productively use the distribution of VPO through copies of official app stores, fake official brand websites, and offer APK downloads through channels and messenger bots.
In addition, as the analyst notes, the removal of applications with web versions often leads to an increase in the number of phishing pages for authorization in accounts. According to Dmitry Galov, such schemes are designed for the widest possible audience — in fact, for any user who is looking for a way to return a familiar application after its removal from the official store.
In such a situation, a person may be willing to take the risk and install a program from an unverified source, hoping to restore access to the service. However, if a user downloads a malicious program instead of a legitimate application, he risks transferring confidential information to attackers, including credentials, banking application information, or providing them with access to the device to carry out further attacks, the expert warns.
How to protect yourself from schemes on the topic of deleting applications
In order to protect themselves from fraud schemes on the topic of deleting applications, experts interviewed by Izvestia advise following certain rules of cyber hygiene. According to Maxim Alexandrov, protection is based on two main principles: preparation and verification.
— It is recommended to study legal ways of accessing services in advance (for example, install RuStore), which allows you to avoid haste, — says the interlocutor of Izvestia. — The links received must be checked against the official addresses, paying attention to the slightest distortion in the domain.
You should not follow links from questionable messages and download files of unverified origin, the expert notes. It is recommended to manually enter the address of the official website in the browser or contact support at a known number. In turn, Dmitry Galov advises using a modern security solution for a mobile device. It will help you detect known malware and warn you about switching to phishing resources.
"If a suspicious application has already been installed, it should be removed as soon as possible using a security solution, update the operating system and all installed applications, and change passwords for important services," concludes Izvestia's source.
Переведено сервисом «Яндекс Переводчик»
