In September, a new community of fraudsters started operating in the Runet domain, whose members, under various pretexts, encourage people to download various malicious Android applications imitating delivery services, which are actually created to steal money. This was reported to Gazeta.Ru by the press service of the information security company F.A.S.S.T.

The scheme works as follows։ members of the fraud team create fake advertisements for the sale of products on specialized websites. After finding a potential buyer and making sure that they are ready to pay for the product, scammers convince them victim to continue the conversation in the messenger. In the Messenger, the victim is sent a link to a malicious program that can supposedly be used to arrange the delivery. The whole legend is based on the fact that he is allegedly a sole proprietor and has to use a special program to buy goods and deliver them to customers.

After clicking on the link, the victim is directed to a fake page imitating Google Play, from where he has to download and install a mobile application that quite accurately copies the design and functionality of real online platforms. This is where the buyer should arrange the shipment. At the time of payment, a specific mobile malware copies and sends the victim's bank card details to another member of the criminal group, followed by an incoming SMS with a transfer confirmation code to steal money from the victim's account.

According to F.A.C.C.T., bank customers in both Russia and Belarus were affected by fraudsters' actions in September. Over 10 days in September, attackers using fake apps managed to steal almost 3 million rubles using a new scheme called Mammoth.

To avoid falling prey to such schemes, F.A.C.C.T. experts remind that it is necessary to follow the basic rules of digital literacy. In particular, you should not transfer communication from the chat of popular announcement services to messengers, you should not follow the links of strangers sent in messengers or by mail, you should download only official applications that you yourself found in the mobile application store or on the website of a legitimate service.