Android App on Play Store Uncovered as Belarusian Spyware

• An app pretending to be part of an independent Belarusian media network is actually spyware.
• The software was tracking users’ locations and sent the data to Russian infrastructure.
• There’s no link with the Minsk government or Moscow, but the setting is very suspicious.

An app posing as a Belarusian media streaming platform named “Nexta Live” was discovered to be essentially spyware. Google has removed it from the Play Store, but its three weeks of presence have already resulted in thousands of installations from Belarusian users.

“Nexta Live” pretends to be part of the Nexta project, an independent Belarusian news agency that maintains a clear stance against the Lukashenko regime. The platform has exposed several police brutality incidents and has broadcasted demonstrations that other Belarusian media refuse to cover.

Related: Belarus Police Raids Uber Minsk Office Looking for Protester Data

The Nexta project, which maintains two Telegram channels, stated that the particular app is not associated with them and so people shouldn’t trust it. In fact, their official team warns that the app is designed to collect data from the users and actually de-anonymize those who participate in anti-Lukashenko protests.

Following this advice, many users reported the app to Google, left 1-star reviews on the Play Store, and generally helped create a negative buzz around it. This has drawn the attention of Google, and the app was removed from the Play Store.

This has sparked the interest of malware researchers, who analyzed the app to discover more about it. Apparently, “Nexta Live” collects geolocation data and also attempts to gather device owner information. The data is sent to a Russian IP address at regular intervals, which is the same one resolved by other suspicious domains too. That said, there’s no concrete link between the Belarusian government and the app, but the connection to Russian infrastructure is an interesting finding nonetheless.

President Putin has supported Lukashenko during these turbulent times, and have together knitted the narrative that foreign forces are responsible for inciting the ongoing social unrest in Belarus. Despite all that is going on, there’s a large number of people out on the streets, protesting against Lukashenko and calling him to resign. The police answer with more arrests, beatings, and detentions - but this only fuels the fire inside people’s hearts even more.

From his side, Lukashenko, who is considered a common dictator by most countries in the world, has recently stated that there will be no new elections until someone kills him. This rings a bell on how the Ceausescu and the Gaddafi rules ended, and presidents who lean towards authoritarian administrative methods should be more careful with what they wish for.