The Indian Cyber Crime Coordination Centre (I4C), under the Home Ministry, has identified a concerning trend in financial frauds linked to malicious Android applications. These apps, cleverly disguised as pornography applications, are being promoted through advertisements on popular social media platforms like Facebook and Instagram.
Operating under various names such as “Night Play,” “Reloop,” “Kyss,” “Vimo,” “Rivo,” “Nexo,” and “Vixa,” these applications are primarily distributed via ads that redirect users to websites featuring pornographic content. Once on these sites, users are encouraged to download APK files, often from sources outside the Google Play Store.
Modus operandi
- Distribution: The malicious applications are disseminated through advertisements related to pornographic content on Facebook and Instagram, which lead users to phishing websites.
- Redirection: These ads redirect users to phishing sites, predominantly using domains that end in “.live.” Users are persuaded to download and install APK files from these unverified sources.
- App update: A secondary package is downloaded under the guise of an app update, exploiting permissions granted to the initial app.
- Abuse of accessibility permission for device takeover: After installation, the app requests accessibility and other sensitive permissions. Once granted, the malware can take control of the device and operate in the background.
- VPN installation: Some of these apps may also install a VPN, routing internet traffic through servers controlled by attackers, thereby compromising user data.
- Unauthorized transactions: With the ability to control the compromised device, these malicious applications can facilitate financial fraud.
Precautions and safety recommendations
- Only install applications from the Google Play Store or other reputable app stores.
- Avoid downloading APK files from advertisements, websites, or suspicious links.
- Do not grant accessibility permissions to unknown applications.
- Regularly review installed applications and remove any that are unfamiliar.
- Ensure Google Play Protect is enabled and keep your Android device updated.
- Monitor your bank account and UPI transactions frequently.
Steps to uninstall
Step 1: Start your phone in Safe Mode: Press and hold the Power button, then press and hold Power off until the Safe Mode option appears. Click OK or Restart in Safe Mode, and wait for the phone to restart. “Safe Mode” will display at the bottom of the screen.
Step 2: Uninstall the app: Open Settings, navigate to Apps, select the suspicious application, and tap uninstall. Remove any other unknown or related applications.
Step 3: Restart normally: Restart the phone, and the device will exit Safe Mode automatically.
