Russia takes security seriously, and I'm not just talking about state secrets. The fine folks at Kaspersky have been releasing excellent antivirus products from their headquarters in Moscow since 1997. But the Cold War over malware is far from finished in the former Soviet Union. This week's mobile threat tip from Malwarebytes pulls back the Iron Curtain on a malicious Russian Android app pretending to be the Google Play store itself.

From Russia With Hate

Many Russian Android owners do not have access to the Google Play store and other Google Service apps. So they have to download apps from other, less reliable sources. Google Play Market (Android/Trojan.FakePlay.as) lurks in these shadowy alleys and sells itself as an update for the real Google Play store. Without an official alternative to turn to, Russian users are tricked into downloading the Trojan.

The app displays a fake progress bar to mimic an install process, but in reality it runs as a service in the background with no visible icon in the launcher. After it has taken root, the app then requests Device Admin permission and tries to change the phone's unlock password to '12345.' The sad thing is that's probably a stronger password than what many other smartphones owners use.

The fake Google Play Market also monitors SMS messages and can reply to or dismiss messages for premium services. Although the specific premium services are currently unknown, presumably this is how the malware makes money for its creators at the victim's expense. Last year we discussed another, similar Russian-specific mobile threat called Samsapo that texted Cyrillic messages to premium numbers to "ravage Russian wallets."

Staying Safe

Normally this is the part where we say the best way to avoid catching Android malware is to only download apps from the Google Play store, and most of the world should still follow that advice. But fake apps like Google Play Market only proliferate because the Google Play store isn't accessible in Russia. That combined with the massive, complex Android malware industry operating inside the country means Russian Android owners just have to be that much more careful.

Fortunately, anyone can purchase Android security products from trustworthy sources like Kaspersky and Malwarebytes as well as Editors' Choice winners Avast and Bitdefender. Or maybe Russia could just ask Edward Snowden for some security tips before he flees the country.