NewApp Digest
search bot

cybercrime

I4C warns against malicious Android apps from social media ads
AppWizard
September 4, 2026

I4C warns against malicious Android apps from social media ads

The Indian Cyber Crime Coordination Centre (I4C) has issued an advisory about malicious Android applications disguised as adult-content apps, which are promoted through social media and distributed outside official app stores. The National Cybercrime Threat Analytics Unit (NCTAU) warned that these apps can compromise mobile device security by requesting sensitive permissions and may install additional software without user consent, leading to unauthorized financial transactions. Users are advised to download apps only from trusted sources like the Google Play Store, avoid installing APK files from unverified sources, and refrain from granting accessibility permissions to untrusted applications. Recommendations include regularly reviewing installed apps, keeping Google Play Protect enabled, and monitoring bank accounts for unauthorized activities. Victims of cyber fraud are encouraged to report incidents via the national cybercrime helpline or the government’s reporting portal.
Fake porn apps that can hijack your Android phone
AppWizard
September 3, 2026

Fake porn apps that can hijack your Android phone

The National Cybercrime Threat Analytics Unit (NCTAU) has reported a rise in financial fraud linked to deceptive Android applications that pose as pornography apps. These apps are advertised on social media platforms like Facebook and Instagram under names such as ‘Night Play’, ‘Reloop’, ‘Kyss’, ‘Vimo’, ‘Rivo’, ‘Nexo’, and ‘Vixa’. Users who click on these ads are redirected to websites promising adult content, where they are encouraged to download APK files. Once installed, these apps often request sensitive permissions, particularly Accessibility access, which can allow malware to take control of the device and facilitate financial fraud. Some malicious apps may also install a VPN, rerouting internet traffic through servers controlled by attackers and exposing sensitive data. The malware is primarily promoted through ads linked to pornographic content, redirecting users to phishing websites that prompt APK downloads from non-Google Play sources, often using the “.live” domain extension. After installation, the initial app may download a second malicious package disguised as an update, exploiting the permissions granted to the original app.
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Winsage
September 2, 2026

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using counterfeit software-download websites to distribute malicious installers, primarily targeting users seeking popular software. This campaign has significantly affected China-based operations of multinational corporations and Chinese-speaking users. The malware, once executed, can establish persistence, undermine security measures, and communicate with attacker-controlled infrastructure. Victims span various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft associates this campaign with a Chinese threat cluster called Silver Fox, known for using spoofed vendor download pages to spread Gh0st RAT and ValleyRAT. The malicious websites are hosted on .com.cn and .hl.cn domains, featuring Chinese-language content. The downloaded files are dynamically generated, and upon execution, they deploy a wrapper installer that initiates the malware payload. The malware achieves persistence through scheduled tasks and interferes with Windows Update services. The campaign establishes command-and-control communication over non-standard ports, with two identified domains linked to the activity. Microsoft Defender has detected the threat and initiated containment procedures. Kaspersky reported a related malicious installer exploiting a legitimate adware application to execute a backdoor, which captures keystrokes and clipboard contents. ValleyRAT, a sophisticated implant, can collect system information, reboot the computer, capture screenshots, and transmit logs. The attackers are motivated by cyber espionage and financial gain, targeting organizations globally. A subgroup within GoldenEyeDog, known as CuboidalCanine, has also been linked to the use of ValleyRAT, particularly in the gambling industry. In June 2026, Chinese authorities addressed cybercrime cases involving a new variant of the Silver Fox trojan.
Fake Porn Apps Target Android Users Via Ads On Facebook, Instagram: How To Stay Safe
AppWizard
September 1, 2026

Fake Porn Apps Target Android Users Via Ads On Facebook, Instagram: How To Stay Safe

Cybercriminals are targeting Android users with deceptive advertisements for malicious applications disguised as pornographic content on platforms like Facebook and Instagram. The National Cybercrime Threat Analytics Unit (NCTAU) has reported that these ads lead users to phishing traps or malware downloads that can compromise banking credentials. Malicious applications linked to this threat include “Night Play,” “Reloop,” “Kyss,” “Vimo,” “Rivo,” “Nexo,” and “Vixa.” The scam involves promoting these apps through enticing ads, redirecting users to websites offering pornographic content, and prompting them to download APK files directly from these sites, often using “.live” domains. The initial app may request users to download a second package disguised as an update, which can exploit permissions granted to the first app. This malware can gain extensive control over the device, potentially installing a VPN that routes internet traffic through attackers' servers. To protect against this threat, users should download apps only from trusted sources, avoid installing APK files from ads or suspicious links, refrain from granting Accessibility access to unknown apps, regularly review installed apps, keep Google Play Protect enabled, and monitor bank accounts for unusual activity. If a suspicious app cannot be uninstalled, users can try Safe Mode, remove special permissions, or perform a factory reset as a last resort.
Fake dating apps are being used to target Android users: How the new cyber scam works
AppWizard
August 31, 2026

Fake dating apps are being used to target Android users: How the new cyber scam works

India's cybercrime authorities have warned about the misuse of dating and adult-themed advertisements on social media platforms like Instagram and Facebook, which are being exploited by criminals to distribute malicious Android applications. These ads redirect users to external websites where they are prompted to download APK files, bypassing security measures of trusted app stores. The Indian Cybercrime Coordination Centre (I4C) has identified several malicious applications, including Night Play, Reloop, Kyss, Vimo, Rivo, Nexo, and Vixa, and cautions against installing unfamiliar applications promoted through unsolicited ads. These apps may request sensitive permissions, such as access to SMS messages, contacts, photos, device storage, and Accessibility Services, which can allow fraudsters to access valuable information. Compromised devices can lead to financial fraud by intercepting OTPs and other verification details. The I4C recommends using trusted app stores, keeping Google Play Protect active, reviewing app permissions, and being cautious with social media ads. If a suspicious app is installed, users should restart their phone in Safe Mode to uninstall it, disable its permissions if necessary, and consider a factory reset if removal fails. Users who suspect fraud are encouraged to report incidents promptly.
What Prevents Zero-Day Exploits? A Practical Guide to Stopping Unknown Threats
Tech Optimizer
July 27, 2026

What Prevents Zero-Day Exploits? A Practical Guide to Stopping Unknown Threats

Zero-day exploits are attacks that take advantage of previously unknown software vulnerabilities before a vendor can issue a patch. These exploits pose significant challenges because organizations cannot address vulnerabilities they are unaware of, and traditional security measures may not effectively identify them. Zero-day vulnerabilities are distinct from zero-day exploits; the former refers to the software flaw itself, while the latter is the method used by attackers to exploit that flaw. Zero-day exploits are particularly dangerous because they give attackers a temporary advantage, allowing them to compromise systems before defenders can respond. These exploits are commonly used in advanced attacks, including ransomware campaigns and espionage. The lifecycle of a zero-day exploit typically involves discovering a vulnerability, weaponizing it, delivering the exploit, executing malicious code, and achieving the attacker's objectives. Traditional antivirus solutions may not consistently prevent zero-day exploits, as they primarily focus on known threats. Endpoint Detection and Response (EDR) platforms provide visibility and detection but do not inherently prevent exploitation. Effective prevention strategies emphasize stopping the exploitation techniques themselves, rather than solely relying on detection. Memory-based attack prevention is a key approach, as all exploits must execute within memory. This method disrupts exploitation techniques and can protect against unknown vulnerabilities. Best practices for preventing zero-day exploits include reducing the attack surface, enforcing least privilege, maintaining aggressive patch management, strengthening identity security, deploying prevention-based endpoint protection, and maintaining a layered security strategy.
Centre bans Bitchat app used during internet curbs; cites security risks
AppWizard
July 27, 2026

Centre bans Bitchat app used during internet curbs; cites security risks

The Indian government has instructed GitHub to remove the Bluetooth-based messaging application Bitchat due to concerns about its potential misuse for anti-national activities, including terrorism and cybercrime. The directive was issued by the Indian Cyber Crime Coordination Centre (I4C), which noted that Bitchat's decentralized communication through Bluetooth mesh networks hinders lawful interception and investigations by law enforcement agencies. The lack of a centralized service provider complicates the ability to trace communications and gather data for investigations.
Search