Indian Cyber Crime Coordination Warns of Financial Fraud via Fake Pornography Apps on Facebook and Instagram
Quick Look
- Indian Cyber Crime Coordination (I4C) warns of rising financial fraud through malicious Android apps posing as pornography applications, distributed via Facebook and Instagram ads.
- These apps gain device control through accessibility permissions, install additional malware, route traffic through attacker-controlled servers, and may prevent uninstallation, leading to potential financial theft.
- Authorities advise downloading apps only from trusted sources, reviewing installed applications, and monitoring bank and UPI transactions regularly.
AI-generated summary
Why It Matters
Indian Cyber Crime Coordination (I4C) has observed a rise in financial fraud perpetrated through malicious Android applications masquerading as pornography apps, circulated through Facebook and Instagram advertisements.
Indian Cyber Crime Coordination warns of financial fraud via fake pornography apps. These malicious applications are advertised on Facebook and Instagram platforms. Users are tricked into downloading APK files from suspicious websites and links. Once installed, these apps gain device control and can prevent uninstallation. Authorities advise downloading apps only from trusted sources and monitoring transactions.
New Delhi: Indian Cyber Crime Coordination (I4C) has observed a rise in financial fraud perpetrated through malicious Android applications masquerading as pornography apps, circulated through Facebook and Instagram advertisement operating under 'Night Play', 'Reloop', 'Kyss', 'Vimo', 'Rivo', 'Nexo', 'Vixa' and other similar variants.
According to an I4C advisory, "These applications are primarily distributed through advertisements on Facebook and Instagram, which redirect to websites serving pornographic content, where the user is prompted to download the APK (a package form used by Android). After installation, the app requests permissions that allows it to install additional applications and by abusing accessibility permission, takes control of the users' device, which may result in financial fraud. Some apps also install a VPN, which may be used to route internet traffic pertaining to malicious and criminal activity. The app may prevent users from uninstalling it through the device settings."
‘primarily distributed VIA advertisements on Facebook, Instagram’: 14C
The malicious application is distributed through pornographic content-related advertisements or links majorly on Facebook and Instagram. These ads redirect to phishing websites. In most cases, domains of the website majorly belong to "live". Users are persuaded to download and install the APK from sources outside the Google Play Store, the advisory noted.
It added, "A secondary package gets downloaded and installed on the pretext of an app update, based on permissions abused by the first. After installation, the application asks users to grant accessibility and other sensitive permissions. Once enabled, the malware gains control of the device and continues to run in the background. Some apps may also install a VPN on the device, thereby routing all internet traffic through attacker-controlled servers. This compromises user's transmitted data, which may be exploited for malicious or criminal activities."
Since the malware has the ability to take over the compromised device, installing such apps may lead to financial fraud. I4C said that applications should be downloaded only from Google Play Store or other trusted app stores. Do not download APK files from advertisements, websites or suspicious links. Do not grant accessibility permission for unknown applications. Review installed applications and remove any app you do not recognise. Keep Google Play Protect enabled and keep your Android device updated. Check your bank account and UPI transactions regularly.
What to Watch
AI outlook — possibilities, not facts
I4C will issue further advisories if new variants of the malware emerge
Likely · Within weeks
Users who follow I4C's advice will see reduced infection rates
Possible · Within months
Open Questions
- How many users have been affected by these malicious apps so far?
- Are the operators behind these apps located in India or abroad?
- What specific legal actions is I4C planning against the distributors of these apps?
- Have Facebook and Instagram taken down the malicious advertisements mentioned in the advisory?
