One Click, Empty Bank Account? Centre Flags Adult Apps On Social Media

Your next financial fraud may not begin with a phone call. It may begin with an advertisement.

A tempting video pops up on Facebook or Instagram. You click it. You are taken to a website. The site asks you to download an app to watch the content.

The file may look harmless. But it is not.

India's cybercrime authorities have warned that a new wave of malicious Android applications is being used to target users and facilitate financial fraud. The apps are being promoted through advertisements on Facebook and Instagram and are disguised as pornography or adult-content applications.

The Indian Cyber Crime Coordination Centre (I4C), set up the Ministry of Home Affairs, has flagged apps operating under names such as "Night Play", "Reloop", "Kyss", "Vimo", "Rivo", "Nexo" and "Vixa", among others. 

How The Scam Works

According to the I4C advisory, users are redirected from social media advertisements to websites offering adult content. They are then persuaded to download an Android Package Kit, or APK, from outside the Google Play Store.

Once installed, the app can ask for sensitive permissions. The malicious software can abuse Android's Accessibility Services to gain control over the device. It can also download another package by disguising it as an app update. Some variants may install a VPN and route internet traffic through servers controlled by attackers.

In some cases, the malware can even make it difficult for users to remove the application. For an ordinary smartphone user, that can mean handing over control of the same device that holds banking apps, UPI accounts, OTPs and personal information.

Mayank Morya, Co-founder and CTO of Mitigata, told NDTV the scam works because it exploits familiar user behaviour. "These apps work because they target two habits most Indian phone users have: chasing something free and tapping 'Allow' without reading it," Morya said.

He warned that an APK promoted through a Facebook advertisement does not have the safeguards or accountability associated with an app distributed through an official store. Once inside the phone, a malicious app can potentially read OTP messages, appear over banking or UPI applications and capture sensitive information, he said.

Accessibility Permission Can Become A Backdoor

Accessibility Services is meant to help people who have difficulty operating a touchscreen. But giving the same access to an unknown application can be dangerous.

Morya said a malicious application with Accessibility access can read the screen, interact with other applications and even approve permission requests on the user's behalf. He pointed to several warning signs.

A phone tapping by itself. An unfamiliar VPN icon. Or an unknown application appearing under the Accessibility settings.

"Never grant this permission to anything except a genuine screen reader," Morya said. If an app is asking you to find a workaround to install or enable something, that should be treated as a major red flag.

Social Media Scams Becoming Harder To Ignore

Varun Grover, Business Unit Head at mFilterIt, said digital fraud is increasingly moving "upstream" -- from the point where a payment happens to the point where a victim first discovers the fraudulent offer. "Malicious apps promoted through social media are a warning that digital fraud is moving upstream, from the point of transaction to the point of discovery," Grover told NDTV.

If a fraudulent promotion reaches consumers through a platform they already trust, the first line of defence cannot begin only after the app has been downloaded. Grover said platforms and the wider digital advertising ecosystem need stronger checks on advertisers, greater transparency around promotions and faster action against deceptive campaigns.

"Trust is the foundation of the digital economy," he said, adding that consumers cannot be expected to remain suspicious of everything they see online. The responsibility, he said, must be shared by platforms, advertisers and ecosystem partners.

What Android Users Should Do Now

The I4C has advised users to download applications only from Google Play Store or other trusted app stores. APK files received through advertisements, websites or suspicious links should be avoided.

Users should also:

• Keep Google Play Protect switched on.
• Keep their Android phones updated.
• Avoid giving Accessibility access to unknown apps.
• Review installed applications regularly.
• Remove apps they do not recognise.
• Monitor bank accounts and UPI transactions frequently. 

Morya has an even simpler rule: "If it's not on the Play Store, it doesn't go on the phone." And if a device has already been compromised, speed matters. "Don't sit on it. Call 1930 within the hour," Morya said, referring to India's cybercrime helpline.

For companies, the risk does not stop with personal phones. Employees may use the same device for work emails, banking and personal entertainment. Morya said organisations should consider blocking sideloading on devices that access company data and have a response plan ready to freeze accounts and involve their cyber insurer quickly.