A Russian‑language app named Cириус surged to the third‑most‑downloaded free slot on the U.S. App Store on Friday. Marketed as a Pomodoro timer, it offers task lists, analytics and “cosmic” results but provides no English interface. Typically the top three are OpenAI, Anthropic or Google chatbots, with occasional spikes from streaming or reality‑TV voting apps.

Investigation on Telegram revealed the program is actually a client for sanctioned state bank VTB Bank. Because U.S. sanctions bar VTB from distributing software, the institution allegedly uses shell developer accounts and disguises the banking client as a productivity tool to slip past Apple’s vetting. Apple has not yet removed the app, but removal appears imminent.

The episode shows how App Store rankings can surface malicious software that evades detection. Consumers downloading top‑chart apps should verify language support and developer credentials, especially when an app’s description seems generic. Until Apple pulls Cириус, users are advised to avoid the app entirely. Apple’s review process has faced criticism for missing such subterfuge, highlighting the need for stronger language‑based screening.

Regulators may pressure Apple to tighten vetting of foreign apps, especially those linked to sanctioned entities, to protect U.S. users. A stricter review could force developers to disclose language support and real functionality, reducing the chance that banking tools masquerade as productivity utilities on iOS.