Apple App Store Hosts Sanctioned Russian Bank’s Disguised App

🚨 BREAKING

The third most downloaded free app in the United States on Friday was a Russian-only Pomodoro timer called Sirius, which security researchers and Telegram users identified as a disguised mobile banking client for VTB Bank, a Russian institution under heavy U.S. sanctions.

VTB has been sanctioned by the U.S. government since 2022, which bars it from distributing software through American app marketplaces. The bank has apparently responded by routing its mobile client through shell developer accounts and dressing the app as something mundane enough to pass initial review. A star-shaped icon and a task management description were enough to get through the door.

The tell was the charts. A Russian-language-only productivity app has no plausible path to the top three in the U.S. store through organic downloads. The volume of installs from existing VTB customers trying to access their accounts is what pushed it into public view and, in effect, exposed the whole operation.

What the App Actually Claimed to Offer

The App Store listing described Sirius as a Pomodoro timer with:

• Short active work sessions followed by five-minute breaks
• Built-in analytics and task history
• Voice note support for daily focus tracking

None of those features are why anyone downloaded it.

This is not the first time sanctioned Russian entities have used disguised apps to reach customers inside markets that have blocked them. Apple’s review process screens for known developer identities and stated functionality, but it has limited visibility into what a app does once it connects to external servers after installation.

Apple has not publicly commented, but removal is the likely outcome now that the app’s ranking made the deception impossible to miss. The more durable question is how many similar apps clear review without ever climbing high enough to draw attention.