Rising Threat of Financial Fraud via Malicious Android Apps
The National Cybercrime Threat Analytics Unit (NCTAU) has issued a cautionary note regarding an alarming increase in financial fraud linked to deceptive Android applications masquerading as pornography apps. These applications are primarily being advertised on popular social media platforms, such as Facebook and Instagram, under various enticing names including ‘Night Play’, ‘Reloop’, ‘Kyss’, ‘Vimo’, ‘Rivo’, ‘Nexo’, and ‘Vixa’, among others.
Upon clicking these advertisements, users are redirected to websites that promise adult content, enticing them to download an APK (Android Package Kit) file. This seemingly innocuous action can lead to significant security risks. Once installed, these applications often request sensitive permissions, notably Accessibility access, which can enable the malware to seize control of the device and potentially facilitate financial fraud.
- Some of the malicious apps may also install a VPN, rerouting the user’s internet traffic through servers controlled by the attackers, thereby exposing sensitive data.
What does the malware do?
The malicious applications are predominantly promoted through advertisements and links associated with pornographic content on social media. These ads cleverly redirect users to phishing websites that not only offer adult content but also prompt users to download APK files from sources outside the Google Play Store. Notably, many of these domains utilize the “.live” extension, adding an air of legitimacy to their deceptive practices.
After the initial installation, the first app may download a second malicious package, cleverly disguised as an app update. This is achieved by exploiting the permissions granted to the original app. By requesting users to enable Accessibility and other sensitive permissions, the malware can gain control of the device, allowing it to operate undetected in the background.
