T-Bank Masks New iOS Banking App as K8CHEN PRO to Bypass Sanctions
T-Bank has published a new version of its mobile banking application for iPhone that is deliberately hidden in the App Store under the name K8CHEN PRO. After installation and successful authentication, the application renames itself to 8PRO on the user’s device.
The app is currently available for download in the Russian, Kazakh, Turkish, Georgian, and American App Store regions. Its authenticity is verified by a direct link published on the official T-Bank website.
The unusual naming strategy is not related to kitchen appliances. Following the imposition of sanctions against Russia, official applications of Russian financial institutions are regularly removed from the App Store. Banks therefore release updated versions under neutral titles. The lifespan of such releases in Apple’s store can sometimes be measured in mere hours.
Users are recommended to download K8CHEN PRO exclusively through the link provided on the official T-Bank website. Searching for the application manually by name carries significant risk, as fraudsters regularly copy banking services, logos, and descriptions to harvest logins, passwords, and confirmation codes.
After installation, users are advised not to delete the application even if it later disappears from the App Store, as the already downloaded version will continue to function on the device. Before logging in, it is essential to confirm that the link originates directly from the bank’s website rather than from advertisements, Telegram channels, or messages from supposed support staff.
Related articles
Rospotrebnadzor and FAS to Extend Oversight to Websites: Automating Foreign Word Replacement Using LLM
Russian compliance experts have developed a specialized microservice called Normograph that combines multi-stage filtering, OCR, and LLM processing to help organizations meet the requirements of Federal Law 168-FZ on protecting the Russian language. The system automatically identifies prohibited foreign borrowings and Latin script on websites, cross-references them against official dictionaries approved by the Russian Academy of Sciences, and suggests context-aware Russian replacements while preserving marketing meaning and grammatical agreement. It excludes registered trademarks, brand names, and terms without Russian equivalents using dynamic white lists and Rospatent data. The solution processes pages up to 20 times faster than manual review by filtering out already-compliant words before sending only problematic fragments to the language model. An OCR module based on Yandex Cloud Vision extends checks to images and banners. The service was built with GigaChat API but remains provider-agnostic and avoids sending full pages or confidential data to foreign AI services.
Separating Identity and Delivery Channels for Compliant Telegram Mini App Authentication
A developer shared a detailed case study on building legally compliant user identification for Telegram Mini Apps targeting Russian audiences. Instead of relying solely on Telegram initData verification, the project routes authentication through established Russian providers including VK ID, Yandex ID and MAX. Identity is handled separately from message delivery channels, with telegram_id used only for notifications after account creation. The implementation employs OAuth 2.1 with PKCE for VK, OAuth 2.0 for Yandex, and deep links for MAX while enforcing short-lived cryptographic state values and HttpOnly session cookies. Additional measures include consent checkboxes required by Russian law and polling-based result delivery to support browser, WebView and extension environments. The same architecture was reused for Home Assistant smart-home login, demonstrating reusable separation of identity and channel concerns.
FSTEC Publishes 35-Point Network Perimeter Recommendations, Most Require No Spending
Russia's FSTEC released non-binding recommendations on protecting network perimeters on March 10, 2026, analyzing real-world intrusion vectors from external networks. The 35-point checklist spans eight sections covering device administration, DDoS resilience, segmentation, configuration backups, vulnerability management, authentication, logging, and incident response exercises. Only four items explicitly require purchasing new tools such as WAF, ZTNA, NAC, and SIEM, while five others depend on existing infrastructure. Twenty-six points can be addressed through policy, inventory, and configuration changes alone, including enforcing unique passwords, disabling legacy protocols like HTTP and SNMP v1/v2, and quarterly backup restoration tests. The document references Order 117 and earlier FSTEC methodologies on vulnerability handling, serving as a practical self-assessment questionnaire rather than a mandatory regulation. Analysts note that many organizations still fail to implement low-cost measures such as excluding remote administration interfaces from DMZ zones and verifying backup recoverability.
Compliant Telegram Mini App Authentication via Russian ID Providers in My Anti-Social Network Project
The project 'My Anti-Social Network' demonstrates a production-grade approach to Telegram Mini App authorization that meets Russian identification requirements by separating user identity from delivery channels. Instead of relying solely on Telegram initData verification, the system routes authentication through VK ID, Yandex ID, and MAX using OAuth 2.0 / 2.1 flows with PKCE. Sensitive tokens never reach the browser; the client receives only short-lived one-time codes exchanged for HttpOnly session cookies. The architecture supports multiple front-ends including PWA, browser extensions, and Home Assistant integration while maintaining cryptographic protections around state parameters and code verifiers. The solution was implemented for an aggregator delivering personalized news feeds through Telegram, MAX, VK bots, and voice assistants.