FireScam Android Malware: A New Threat Disguised as Telegram

Introduction

Mobile malware remains one of the greatest threats in the world of technology today with many unscrupulous apps bobbing up from time to time. A prime example is the recent FireScam Android app which impersonates the popular messaging platform Telegram. The fraudulent software has been developed to steal sensitive user data and it’s dangerous to say the least. This blog further elaborates how FireScam operates, its potential impact, and best practices to protect against such threats[1].

What is FireScam Malware?

As the name, FireScam suggests, the app in question is the perfect blend of neo cyber and scamming as it uses social engineering tactics to deceive the user into thinking that it is a paid version of the regular Telegram app. The end goal of FireScam is to gain access to the user’s private data, and selling the app online allows the developers to perform just that. The app is hosted on GitHub.io domain that mimic RuStore, Russia’s alternative app marketplace. Once the user installs the app, FireScam uses a dropper APK that installs the main payload to get extensive  permission to monitor notifications, intercept SMS, capture clipboard data and e-commerce transactions. All the data captured is then uploaded in real time onto a secure Firebase database ensuring minimal risk of getting caught. The app then connects to a WebSocket to seamlessly execute remote commands and download the necessary information without being detected. The malware spreads by exploiting trust in legitimate-looking platforms, emphasizing the dangers of downloading apps from unverified sources[2].

Figure 1: RuStore clone hosted on a GitHub.io domain[5]

The Deceptive Strategy of FireScam

FireScam uses a well-coordinated phishing strategy to distribute its malware. The malware is hosted on a fake GitHub.io phishing website that imitates RuStore, Russia’s sanctioned application market. The malware also exploits victim’s trust in legitimate platforms. The phony app claims to offer premium Telegram services, preying on users seeking enhanced messaging features [5].

How Does FireScam Work?

• Disguised App: FireScam mimics the Telegram app to appear legitimate, tricking users into downloading it.
• Permissions Abuse: After installation, it requests extensive permissions under the guise of app functionality.
• Data Theft: The malware siphons sensitive information, including:
• Personal messages and media files.
• Login credentials and PINs.
• Banking and financial details.
• Command-and-Control (C2) Communication: FireScam connects to its C2 server to upload stolen data and receive instructions for further malicious activities.

FireScam’s Capabilities

FireScam is a meticulous data thief as it pays attention to detail targeting different kinds of sensitive information to exfiltrate. Everything begins with a parody of a web view login page where it tricks users into revealing their login details. Furthermore, the malware keeps track of clipboard usage, capturing data like passwords that the user copies, or autofill entries from their password manager. It also meticulously observes e-commerce transactions, in which case the user’s activity during online shopping is recorded so it can acquire sensitive payment details. Apart from this, FireScam also collects personal and some system data such as contact lists, SMS messages, and system logs which are all uploaded to its Firebase database. Once the data is extracted it is temporarily and then filtered for valuable information and thereafter erased to cover all traces from investigators[3].

Upon execution, FireScam leverages a deceptive WebView screen to steal Telegram credentials while establishing communication with a Firebase Realtime Database for real-time data uploads and device tracking. The malware also opens a persistent WebSocket connection with its Firebase command-and-control (C2) endpoint, allowing it to execute commands such as requesting specific data, triggering immediate uploads, downloading additional payloads, and adjusting surveillance settings. FireScam actively monitors screen activity, capturing events like app usage and screen on/off changes, and logs activities lasting over 1,000 milliseconds.

To achieve a complete form of the cyber surveillance, FireScam demonstrates advances spying capabilities by tracking every action done by the users including typing, dragging and dropping and clipboard copying or pasting. Its ability to exfiltrate categorized data to attackers underscores the critical need for heightened vigilance and robust security practices, especially for users relying on third-party app stores or downloading from unfamiliar sources[5].

Figure 2: Exfiltrated content from compromised device on firebase database endpoint [5]

Figure 3: Exfiltrated content from compromised device on firebase database endpoint [5]

Who is at Risk?

Anyone downloading apps from unofficial or unverified sources is at risk. The malware specifically targets Android users and exploits vulnerabilities such as outdated operating systems or lack of security awareness.

Who is Behind FireScam?

While the exact operators remain unidentified, the malware’s sophisticated design suggests it originates from well-resourced cybercriminal groups. Its specific targeting of Russian platforms indicates a strategic alignment with local app store dynamics, possibly leveraging geopolitical trends[3].

How to Protect Against FireScam

• Stick to Official App Stores: Avoid downloading apps from third-party websites, especially those mimicking legitimate platforms.
• Enable Google Play Protect: Android’s built-in security feature blocks known threats.
• Verify App Authenticity: Cross-check app details, developer information, and reviews before installation.
• Educate Yourself: Stay informed about emerging malware threats to identify phishing attempts.
• Limit Permissions: Grant app permissions selectively and review existing permissions regularly.

Conclusion

The FireScam malware highlights the ongoing threats to mobile security, particularly on the Android platform. By leveraging fake app impersonation, attackers exploit users’ trust and access sensitive data. Proper understanding of these threats and proactive measures that counter them is essential for the protection of sensitive personal information of individuals and organizations. When engaging with apps on the internet, remember to be cautious and secure.

References

1. https://www.scworld.com/news/firescam-android-malware-poses-as-telegram-app-to-steal-sensitive-data
2. https://thehackernews.com/2025/01/firescam-android-malware-poses-as.html
3. https://www.bleepingcomputer.com/news/security/new-firescam-android-data-theft-malware-poses-as-telegram-premium-app/
4. https://www.kaspersky.com/resource-center/preemptive-safety/avoid-android-malware
5. https://www.cyfirma.com/research/inside-firescam-an-information-stealer-with-spyware-capabilities/