.jpg?w=602&auto=format%2Ccompress&fit=max&format=webp&dpr=1.0)
I4C warns about fake porn apps linked to financial fraud.
Malware can misuse OTPs, PINs and Accessibility access.
Users are urged to avoid unknown APKs and report fraud.
Android users are being warned about a growing cybercrime tactic in which fake pornography applications are used to gain control of mobile phones and steal money through unauthorised financial transactions.
The Indian Cyber Crime Coordination Centre (I4C) under the Union home ministry has flagged a rise in such financial frauds, with malicious Android applications being promoted through social media advertisements and distributed outside the Google Play Store. According to Hindustan Times, an advisory issued by the National Cybercrime Threat Analytics Unit (NCTAU) on August 26 identified apps using names including “Night Play”, “Reloop”, “Kyss”, “Vimo”, “Rivo”, “Nexo” and “Vixa”, along with similar variants.
The apps are typically presented to users through advertisements that redirect them to websites offering pornographic content. Users are then encouraged to download an Android Package Kit (APK) file from outside the Google Play Store.
How the malicious apps take control of phones
After installation, the applications can request access to sensitive device permissions, including Accessibility access. If granted, these permissions can allow the malware to operate in the background and interact with the device.
The cybercrime unit said attackers can abuse Accessibility features to read information displayed on the screen, click buttons and enter sensitive details such as one-time passwords (OTPs) and PINs. The malware can also be used to confirm transactions and initiate fund transfers, potentially allowing attackers to access victims’ bank accounts and steal money.
Hindustan Times reported that the malicious applications can also download and install another application by presenting it as an update to the original app. In some cases, they may install a virtual private network (VPN) that routes the user’s internet traffic through servers controlled by the attackers, potentially exposing transmitted data to further misuse.
The applications may also try to stop users from removing them through the phone’s normal device settings, making them harder to uninstall.
What Android users have been advised to do
The NCTAU has asked Android users to download applications only through the Google Play Store or other trusted app stores. Users have also been advised not to download APK files advertised through social media, suspicious websites or unknown links.
The cybercrime unit has specifically warned users against giving Accessibility permissions to unfamiliar applications. It has recommended regularly checking installed applications and removing those that are unrecognised, while keeping Google Play Protect enabled and the Android operating system updated.
Users have also been advised to regularly monitor their bank accounts and UPI transactions for any suspicious activity.
What to do if a phone is already compromised
For devices suspected to have been compromised, the advisory recommends restarting the phone in Safe Mode and uninstalling suspicious or unknown applications. Users may also have to disable Accessibility access and remove device administrator privileges that may have been granted to malicious applications.
If an application cannot be removed or returns after the phone is restarted, users have been advised to back up important data and consider carrying out a factory reset.
According to Hindustan Times, the government has urged citizens to report fraudulent applications and cybercrime incidents immediately through the national cybercrime helpline 1930 or the government’s cybercrime reporting portal.
