The Same Phone Risk, Two Different Delivery Models
Russian Android lures and reported Pegasus targeting in Serbia point to different control problems: one turns public anxiety into broad credential theft, while the other requires high-confidence response for people singled out for surveillance.
By Amina Hart · disclosed fictional OMIKINA AI editorial persona · No human review recorded
Published
AI-persona disclosure
Fictional OMIKINA AI editorial persona; not a human reporter and does not hold legal or regulatory credentials or possess firsthand experience.
Key points
- A Russian campaign used apps promising fuel availability, traffic information, unrestricted internet access, and drone-attack mapping to distribute the ZloyRAT Android trojan; researchers did not disclose confirmed download or loss totals.
Sources: S1
- Citizen Lab and the SHARE Foundation said they found high-confidence Pegasus targeting of a Serbian university rector, while a prosecutor received an Apple Threat Notification that the organizations describe as a high-confidence indicator of mercenary-spyware targeting.
Sources: S2
- The practical distinction is delivery: broad Android-lure defenses center on preventing installs and permissions, while suspected mercenary-spyware cases call for rapid, individualized incident handling and preservation of evidence.
One mobile-security problem, sharply different exposure
Two developments published on the same day illustrate why “mobile security” is too broad a planning category. In Russia, cybercriminals are using immediate public concerns—fuel shortages and fears of drone attacks—to market Android tools that purport to help drivers or provide situational awareness. The Record reports that the apps instead distribute ZloyRAT, an information-stealing trojan. In Serbia, Citizen Lab says its work with the SHARE Foundation found, with high confidence, that University of Belgrade Rector Vladan Đokić was hacked with NSO Group’s Pegasus spyware; it also reports that prosecutor Rade Bajić received an Apple Threat Notification. These are not accounts of the same operation, attacker, or objective.
The comparison matters because each incident suggests a different answer to the question, “Which control actually applies?” The Russian campaign is built around persuading many potential victims to fetch software outside a trusted path and grant it access. The Serbian cases concern targeting of identified public figures, where a device warning or forensic finding may be the first visible sign. Treating both as merely an app-awareness problem risks leaving high-risk individuals without a response path; treating broad fraud as only a specialist surveillance issue can miss the initial install and permission decisions that enable theft.
Anxiety is the distribution channel in the Android campaign
The Russian lures are concrete and timely. One app claims to show traffic-police patrols, speed cameras, and stations with fuel in stock. Other fake apps are presented as a free government-backed VPN and as an interactive, real-time drone-attack map. Researchers at F6 said the apps were promoted through a website registered in early October and sought to have it blocked in Russia. The Record says fuel shortages and gasoline-price pressures have been linked in part to strikes on Russian oil refineries, supplying the real-world anxiety that makes such claims plausible.
Sources: S1
Once installed, ZloyRAT presents a recognizable permission-risk pattern. According to F6’s findings as reported by The Record, it can request access to text messages, contacts, and calls; collect incoming messages and notifications; and send messages or place calls. It also targets data associated with more than 60 Russian banking and financial apps, online marketplaces, government services, and Telegram. The malware can show a legitimate website to conceal activity. That detail is important: a victim who sees ordinary-looking web content after installation may not recognize compromise from the app’s visible behavior alone.
Sources: S1
Sources: S1
The evidence supports caution about scale, not complacency
The Record reports that F6 did not disclose how many people downloaded the latest apps or whether the campaign caused confirmed financial losses. Those omissions in the supplied reporting mean the impact of this particular ZloyRAT operation cannot be quantified here. But the reported pattern is broader than a single lure: F6 previously found RadarTrevog delivering RedWing Stealer, and researchers found more than 800 samples hidden in apps advertised as drone alerts, fuel maps, VPNs, and other mobile tools. The same report describes fraudulent fuel-delivery and gas-station-map websites aimed at drivers.
Sources: S1
For organizations, platforms, and communities serving drivers, delivery workers, taxi operators, or truck drivers, the operational requirement is not to assume a useful-looking app is low risk because its subject is mundane. F6 said malicious apps aimed at drivers are typically advertised in relevant online communities. Relevant defenses therefore include clear trusted-download guidance, warnings against granting communications permissions to an unverified utility, and a way to report impersonated services. These are implementation choices, not legal conclusions: the supplied evidence does not establish that any particular measure is mandated by law.
Sources: S1
Sources: S1
Mercenary spyware changes the response threshold
The Serbian reporting describes a more targeted risk environment. Citizen Lab says its ongoing investigation found high-confidence Pegasus targeting of Đokić, a prominent supporter of Serbia’s student movement. It says Bajić, who investigated official corruption connected to a failed Belgrade project, received an Apple Threat Notification, which it characterizes as a high-confidence indicator of targeting with mercenary spyware such as Pegasus. The supplied material also says at least 15 Pegasus-targeting cases were identified ahead of Serbia’s October 25 national elections.
Sources: S2
A threat notification is not the same evidentiary event as the stated high-confidence finding of a hack. The supplied text distinguishes them, and a responsible response should too. A notification warrants urgency, careful preservation, and access to qualified technical assistance; it should not be converted into an unsupported claim about the exact operator, access method, or information taken. Likewise, Citizen Lab says its investigations into these cases are ongoing. The material supplied does not establish who ordered or carried out the targeting, nor does it establish a final outcome for every affected device.
Sources: S2
Sources: S2
Inference: align controls to how the attacker reaches the victim
Inference — The strongest cross-source lesson is that controls should follow delivery model rather than malware label. In the Russian campaign, the attacker’s advantage appears to be relevance at scale: a fuel locator or drone map reaches users through a problem they already need solved. The first defensive opportunity is before installation, then at permission approval, followed by account and device recovery if data may have been exposed. In the Serbian cases, the reported targets’ public roles and the use of specialized spyware indicators point to a different priority: a prearranged channel for trusted alerts, technical triage, legal and organizational support, and evidence preservation.
This does not mean ordinary Android users are responsible for stopping a broad criminal campaign, or that public figures can secure themselves through routine app hygiene alone. App distributors, messaging and community administrators, service operators whose names are impersonated, and employers or civil-society organizations supporting at-risk people all have roles. The Russian report supports action against deceptive promotion and risky permissions; the Serbian material supports taking high-confidence indicators seriously. Neither source, however, supplies a complete remediation protocol, a legal rule requiring a technical control, or evidence that a single intervention eliminates either risk.
What would change the assessment
The near-term watchpoints differ. For the Russian campaign, evidence of download volume, confirmed losses, the campaign’s distribution channels, or continued availability of the website would clarify whether the threat is mostly an attempted lure or a significant fraud operation. Further technical reporting could also establish whether ZloyRAT’s stated capabilities were exercised against victims, rather than merely present in analysis. Until then, the reported risks justify preventive attention but not a claim of measured campaign impact.
Sources: S1
For the Serbian cases, additional forensic findings, clarification of the status of the ongoing investigations, or further information about the scope and timing of targeting would sharpen the picture. The available evidence already supports a high-risk response for affected individuals, but it does not support attribution beyond what Citizen Lab reports. The practical test is simple: broad fear-driven lures demand controls that reduce unsafe installation and permission grants; high-confidence mercenary-spyware indicators demand swift, tailored investigation. Confusing those requirements is itself a security failure.
Why it matters
Both developments show attackers exploiting the information environment around a phone, but the evidence calls for different decisions. Broad fraud relies on believable utility and user action; suspected mercenary spyware requires a specialized response when credible indicators emerge. Security leaders should build both paths rather than applying one generic mobile policy.
Sources
- Malicious apps prey on Russians’ anxiety about fuel prices, drone strikes — The Record from Recorded Future News ·
- Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with Spyware’ — The Citizen Lab ·