Malicious Android applications masquerading as pornography apps are increasingly being used by cybercriminals to take control of users’ mobile phones and carry out unauthorised financial transactions, the Union home ministry’s Indian Cyber Crime Coordination Centre (I4C) warned.
The National Cybercrime Threat Analytics Unit (NCTAU), under I4C, said it observed a rise in financial frauds involving such applications, which are primarily promoted through advertisements on social media platforms. An advisory issued on August 26 identified apps operating under names such as “Night Play”, “Reloop”, “Kyss”, “Vimo”, “Rivo”, “Nexo” and “Vixa”, besides similar variants.
According to the advisory, users are first lured by advertisements that redirect them to websites offering pornographic content. The websites then persuade users to download an Android Package Kit (APK) file from outside the Google Play Store.
What happens after installing these apps?
Once installed, the malicious application seeks sensitive permissions, including Accessibility access. If the user grants these permissions, the malware gains control over the device and continues running in the background.
The cybercrime unit said the attackers can exploit Accessibility features to read information displayed on the screen, click buttons, enter one-time passwords (OTPs) or PINs, confirm transactions and initiate fund transfers. This can ultimately lead to the victim’s bank account being accessed and money being stolen.
{{/usCountry}}The cybercrime unit said the attackers can exploit Accessibility features to read information displayed on the screen, click buttons, enter one-time passwords (OTPs) or PINs, confirm transactions and initiate fund transfers. This can ultimately lead to the victim’s bank account being accessed and money being stolen.
{{/usCountry}}Also Read: Scam Alert: SIR verification call incoming? Beware, it could be a fraud!
The malware may also download and install a secondary application by disguising it as an update to the original app. In some cases, the malicious applications install a virtual private network (VPN), routing the user’s internet traffic through attacker-controlled servers. This could expose transmitted data to further misuse, the advisory said.
The apps may also attempt to prevent users from uninstalling them through normal device settings, making removal more difficult.
The NCTAU has advised Android users to install applications only from the Google Play Store or other trusted app stores and avoid downloading APK files promoted through advertisements, suspicious websites or unknown links.
Users have also been advised against granting Accessibility permissions to unfamiliar applications. The cybercrime unit recommended regularly reviewing installed applications and removing those that are not recognised, while keeping Google Play Protect enabled and the Android operating system updated.
Citizens were asked to regularly check their bank accounts and UPI transactions for suspicious activity.
For devices already compromised, the advisory suggests restarting the phone in Safe Mode and uninstalling suspicious or unknown applications. Users may also need to disable Accessibility access and remove device administrator privileges granted to malicious apps.
If an application cannot be removed or reappears after restarting, users have been advised to back up important data and consider a factory reset.
The government urged citizens to report fraudulent applications or cybercrime incidents immediately through the national cybercrime helpline 1930 or the government’s cybercrime reporting portal.