One fine morning, you are scrolling through Instagram when an advertisement catches your attention. Eager, you click on it, only to be redirected to a website that asks you to download an application to watch the content.
A few taps later, you have unknowingly given a malicious app access to your phone—and to your hard-earned money.
An advisory issued by the Indian Cyber Crime Coordination Centre (I4C) has warned users about malicious Android apps being promoted through Instagram advertisements, including those disguised as entertainment or adult content. Once installed and granted accessibility permissions, such apps can potentially take control of the device, install other applications, and facilitate unauthorised financial transactions.
The National Cybercrime Threat Analytics Unit (NCTAU) observed a rise in financial frauds perpetrated through malicious Android applications masquerading as pornography apps, circulated through Facebook and Instagram ads operating under the names Night Play, Reloop, Kyss, Vimo, Rivo, Nexo, Vixa, and similar variants.
According to the I4C advisory, these applications are primarily distributed through advertisements on Facebook and Instagram, which redirect to websites serving pornographic content, where the user is prompted to download APK files.
After installation, the app requests permissions that allow it to install additional applications and, by abusing accessibility permissions, take control of the user’s device, which may result in financial fraud. Some apps also install a VPN (virtual private network), which may be used to route internet traffic pertaining to malicious/criminal activity. The app may prevent users from uninstalling it through the device settings.
Vikram Raichura, Founder and Managing Director of helo.ai by Vivaconnect, said, “Not every cyberattack needs sophisticated technology to cause serious damage. Some of the most effective Android scams today rely on something much simpler: getting users to approve a permission without understanding what they are allowing.”
Story continues below this ad
How does the scam work?
Advertisement: The malicious apps are promoted through advertisements or links, particularly on social media platforms like Facebook and Instagram, often using pornographic or adult-themed content to lure users. Clicking on these ads can take users to phishing websites.
Pushed to download APK: The websites may appear to offer pornographic content but instead prompt users to download an application or an APK file from outside the Play Store app. The websites are often hosted on “.live” domains.
App installed: Once the app is installed, users may be prompted to download another package, disguised as an app update. The malware can use permissions granted to the first app to facilitate this installation.
Permission granted: The app may ask users to enable accessibility and other sensitive permissions, sometimes claiming they are necessary for the app to work. Once granted, these permissions can allow the malware to take control of the device and operate in the background.
Story continues below this ad
VPN installation: In some cases, the malware can install a VPN on the device and route the user’s internet traffic through attacker-controlled servers. This can expose transmitted data to misuse.
Financial fraud: With control of a compromised device, attackers may then be able to access sensitive information and perform actions on the user’s behalf. Installing such malicious apps can therefore put users at risk of unauthorised financial transactions and other forms of cyber fraud.
Ritwik Batabyal, CTO & Innovation Officer, Mastek Group, said people should remember that a free app or an attractive social media advertisement does not necessarily make an application safe. “If a website asks you to download an APK, especially outside the official app store, it is better to stop and verify before installing it.”
Nidhi Srivastava, cybersecurity expert and founder of DigiArmorX, added, “What makes these scams particularly dangerous is that they combine social engineering with powerful device permissions. A person may click an advertisement on social media, land on an adult-content website and be prompted to download an APK, which is simply a file used to install an Android app outside the usual app-store process. The real danger begins when the app asks for accessibility, VPN, or permission to install other applications. Granting these permissions can potentially give criminals significant control over the device and facilitate financial fraud.”
Story continues below this ad
Precautions and safety recommendations by experts and I4C
📌Download apps only from trusted app stores: Prefer the Google Play Store and avoid installing apps from unfamiliar websites or links.
📌Never download APKs from advertisements or suspicious links: A seemingly harmless advertisement can redirect you to a phishing website and prompt you to install a malicious app.
📌Be extremely careful with accessibility permissions: Never grant accessibility, screen-reading or device-control permissions to an unfamiliar app, particularly when the permission has no clear connection to what the app does. These permissions can give an app significant control over the phone.
📌Watch for unusual permissions: An app that asks for SMS, accessibility, screen-reading, or other sensitive permissions without a clear reason should be treated as a red flag.
Story continues below this ad
📌Keep Play Protect switched on: Google Play Protect can help detect and remove potentially harmful apps. Also keep your Android operating system and apps updated.
📌Do not allow browsers to install unknown apps: Check your Android settings and ensure that browsers and other apps are not permitted to install applications from unknown sources.
📌Regularly review installed apps and permissions: Remove apps you do not recognise and periodically check which apps have accessibility or other sensitive permissions.
📌Look out for unusual behaviour: Unexpected battery drain, a phone heating up while idle, unfamiliar advertisements or other unexplained changes can be signs that a malicious app is running in the background.
Story continues below this ad
📌Monitor your bank and UPI accounts: Regularly check your bank statements and UPI transactions. Report any unauthorised transaction immediately to your bank and the appropriate cybercrime authorities.
The safest approach is not to sideload an APK in the first place. Malicious apps can look like legitimate ones, using familiar names and icons, making them difficult for an ordinary user to identify by appearance alone.
“You can also upload any file you suspect to a public scanning service such as VirusTotal before installing it. If that malware has been seen anywhere in the world before, you will usually get a warning. If it is brand new, it may come back clean, and some apps install harmlessly and download the malicious part afterwards. So treat a clean result as not yet known to be dangerous, not as safe,” said Kaushal Bheda, Director, Pelorus Technologies.
How to uninstall the app
📍Press and hold the Power button, then press and hold Power Off until the Safe Mode option appears. Tap OK or Restart in Safe Mode and wait for the phone to restart. Then go to Settings, select Apps, select the suspicious or unknown application and tap Uninstall. Remove any other unfamiliar or related apps. Restart the phone to exit Safe Mode automatically.
Story continues below this ad
📍Restore the default home screen (if required) by going to Settings, then Apps, then Default Apps, select Home App and select the phone’s original launcher, such as System Launcher, One UI Home or Pixel Launcher.
📍Then go to Settings, select Accessibility, select Installed Services/Downloaded Apps, select the suspicious application and turn off Accessibility access. Next, go to Settings, select Security or Security and Privacy, select Device Admin Apps/Device Administrators and deactivate the suspicious app if it has administrator access. Finally, open Settings, select Apps and verify that the suspicious application has been removed.
If the app cannot be removed or returns after restarting, back up your important data and perform a factory reset.
What else to do
🔺Act immediately: Most damage occurs in the first few hours, so quick action can help limit losses.
🔺Disconnect the device: Switch on aeroplane mode or disconnect it from the internet and stop all banking activity.
🔺Revoke permissions: Disable accessibility, VPN, and device-administrator privileges granted to the suspicious app before attempting to uninstall it.
🔺Contact your bank: If you notice an unauthorised financial transaction, inform your bank immediately, and secure the affected accounts.
🔺Change passwords: Use a separate, trusted device to change passwords for banking, email and other affected accounts.
🔺Report the fraud: Report suspicious transactions through the National Cyber Crime Reporting Portal or by calling 1930.
Story continues below this ad
“A malicious app can ask for excessive permissions such as access to SMS, contacts, photos and notifications. Access to photos and files exposes the gallery, where users commonly store images of PAN cards, Aadhaar, cheque books, and passbooks. These images are used to open accounts, apply for loans in the victim’s name, or as material for extortion,” adds Kaushal Bheda.
The safe side
As the world evolves, the digital landscape does too, bringing new opportunities—and new risks. Scammers are becoming more sophisticated, exploiting vulnerabilities to their advantage. In our special feature series, we delve into the latest cybercrime trends and provide practical tips to help you stay informed, secure, and vigilant online.
