Android fake apps warning
Android users have been warned against downloading suspicious applications promoted through advertisements on Facebook and Instagram. The Indian government has flagged a growing cyber fraud campaign in which malicious Android apps are being disguised as pornography applications and used to gain control of users’ devices and steal sensitive financial information.
The National Cybercrime Threat Analytics Unit (NCTAU), a unit under the Indian Cybercrime Coordination Centre (I4C) of the Ministry of Home Affairs, issued an advisory on the threat. The advisory, published on August 26, identified several suspicious applications and explained how the malware campaign operates.
The warning mentions applications including ‘Night Play’, ‘Reloop’, ‘Kyss’, ‘Vimo’, ‘Rivo’, ‘Nexo’ and ‘Vixa’.
The malicious apps are promoted using social media advertisements designed to attract users with explicit images or video previews. Clicking on such advertisements can redirect users to phishing websites, where they are encouraged to download an APK file from outside the Google Play Store.
Once installed, these malicious applications can request extensive permissions from users. One of the biggest dangers comes from the misuse of Android’s Accessibility feature.
If a user grants the permission, the malware may be able to read information displayed on the screen, access sensitive data such as OTPs and PINs, and gain significant control over the device. This can potentially facilitate unauthorised financial transactions.
The advisory also warns that some malicious applications may download additional packages while pretending to update themselves. In some cases, attackers may install a VPN and route internet traffic through infrastructure controlled by them, creating additional privacy and security risks.
The campaign typically follows a simple chain:
Step 1: A tempting advertisement appears on Facebook or Instagram.
Step 2: The user clicks the advertisement and is redirected to a suspicious website.
Step 3: The website encourages the user to download an APK outside the Google Play Store.
Step 4: The malicious app asks for excessive permissions.
Step 5: Accessibility permissions are exploited to gain control of the device.
Step 6: Sensitive information, including banking credentials, OTPs or PINs, can be targeted for financial fraud.
The government has urged users to install applications only from the Google Play Store or other trusted app stores and specifically warned against downloading APK files from advertisements, suspicious websites or unknown links.
Users who suspect that such an application has already been installed on their device should remove it immediately.
The advisory recommends restarting an affected phone in Safe Mode and uninstalling the suspicious application. If the app cannot be removed normally, users should disable its Accessibility permission and revoke any Device Administrator privileges it may have obtained.
Users should also regularly review the applications installed on their phones and avoid granting unnecessary permissions, particularly Accessibility, SMS and notification access.
The warning comes amid increasing concern over mobile-based financial fraud in India. A seemingly harmless click on a social media advertisement can potentially expose both a smartphone and the user’s bank account to cybercriminals.
© Copyright 2026, cloudTV. All Rights Reserved
