you know how apple is "extremely strict" about what gets on app store and what doesn't? i guess it doesn't apply to literal trojan horse apps that pretend to be one app and switch up to a completely different one inside it
sanctioned russian banks use this all the time! 🧵
recently sber released yet another mock app that pretended to be a lending tracking app, which shortly got taken down
it pretends to be a lending app only in western countries (left), but if your ip is detected as russian, it lets you into the real part of the app (right)
how it does this is by pulling a config that's hosted on a "third party" server (more on that later) right after app start and checks its contents. if it matches whatever criteria they have, then it switches to sberbank online app, if it doesn't, then you get the fake one.