Mammut virus hits Russia’s patriotic messaging app
Even on Max – the messaging system imposed by the Moscow authorities as a ‘secure’ alternative to Western apps – a virus is circulating that steals users’ payment details. According to official figures, there are 100 million user profiles registered on the patriotic chat app, which is mandatory for dealing with public administration. However, knowing that conversations are monitored, many Russians use it on a separate phone.
Moscow (AsiaNews) - A virus dubbed Mamont, or “Mammoth”, has been discovered in the new patriotic messenger app Max – which is being imposed with increasing rigour on Russian institutions and citizens. It is a programme capable of stealing users’ payment details by gaining access to online banking apps.
In reality, it is a virus already well known in basic Android models, which spreads via family and parental chat groups. Fraudsters manage to hack accounts and send highly malicious files to addresses, with the aim of gaining access to communications and bank codes, stealing users’ money and personal data.
The coordinator of the eQualitie project, Leonid Juldašev, explains that the programme launches when a standard message appears: “Is that you in this video?”, which prompts the user to click; at that point, a screen appears – which may show a page loading or a malfunctioning video player – attempting to report a technical error. Meanwhile, a Trojan is downloaded onto the smartphone – the term used to describe programmes that run without the user’s knowledge and steal their data.
Russian authorities and official propaganda tout Max as “a safe space” unlike WhatsApp and Telegram, which are blocked precisely on the grounds of the “fight against cyber fraud”. The spread of the Mamont virus was discovered in early March, whilst the mandatory switch to Max was taking place due to restrictions on Telegram, as experts explain.
According to cyber-lawyer Sarkis Darbinyan, “people are increasingly trusting private chats, where it is assumed that only known individuals are participating, thereby increasing trust in the messages exchanged – precisely the conditions on which fraudsters rely, as they seek to gain people’s trust”.
The press service of the patriotic messenger denies the existence of any problem, stating that “the spread of a virus on Max does not correspond to reality”, and assuring that specialists at the security centre prevent and block any attempt to infiltrate the systems. Darbinyan points out, however, that phishing attacks can occur on any messaging app—whether Max, Telegram or Delta Chat—because “they do not rely on technology or technical defences, but on the psychology of users, which allows for a wide variety of deceptive tactics to be successfully employed”.
All the more so because Max’s distinctive feature lies precisely in the ability of state bodies to monitor conversations, as the expert notes, meaning that “it is important for users to be aware that all their data is constantly being recorded by the state, and therefore there is no shortage of threats to personal security, with repressive measures that may target precisely those who place too much trust in this messaging app”.
According to the press office, there are currently 100 million people registered on Max, and the daily audience stands at around 70 million, although according to Agenstvo, the majority of these accounts belong to state offices, or have been created on the mandatory instruction of public bodies.
Juldašev states that “we see strong resistance among people to using the Max messenger as their primary platform, or as one of their main ones, making it their daily communication tool”. For the most part, people use a second phone, which is already commonly referred to as Maxofon, to fulfil their obligations regarding the use of Max, whilst their main phone is set up with less ‘patriotic’ applications.
If necessary, the Maxofon is shown to superiors and employers, with conversations and government services, payments and electronic signatures, and digital identification available to the authorities – all of which is also very welcome to cyber-fraudsters.
.png)
