The National Cybercrime Threat Analytics Unit (NCTAU), a unit under the Union home ministry's Indian Cyber Crime Coordination Centre (I4C), has warned about a rise in financial fraud linked to malicious Android applications that pose as pornography apps and are promoted through Facebook and Instagram advertisements.

The advisory, issued by the I4C earlier last week, identified apps operating under names including “Night Play”, “Reloop”, “Kyss”, “Vimo”, “Rivo”, “Nexo” and “Vixa”, along with similar variants.

How the apps reach users

According to the advisory, the apps are mainly promoted through pornography-related advertisements or links on Facebook and Instagram. These ads redirect users to websites that serve pornographic content and prompt them to download an APK from outside the Google Play Store.

The websites are largely associated with “.live” domains, the advisory said.

The malware then asks users to grant accessibility and other sensitive permissions. Once these permissions are enabled, the application can gain control of the device and continue running in the background.

VPN and device control

The advisory said some of the applications may also install a virtual private network (VPN). This can route internet traffic through servers controlled by attackers, potentially compromising transmitted data for malicious or criminal activity.

“The app may prevent users from uninstalling it through the device settings,” it said.

The advisory's stated chain of activity runs from the social media advertisement and website redirection to APK installation, VPN installation in some cases, an Accessibility permission request, device takeover and, ultimately, unauthorised financial transactions. This sequence is shown in the advisory's modus-operandi graphic on page 1.

NCTAU's safety recommendations

The NCTAU advised users to install applications only from the Google Play Store or other trusted app stores. It also asked users not to download APK files from advertisements, websites or suspicious links, and not to grant Accessibility permission to unknown applications.

Users have also been advised to review installed applications and remove those they do not recognise, keep Google Play Protect enabled, update their Android devices and regularly check bank accounts and UPI transactions.

Steps to remove suspicious apps

NCTAU has recommended restarting the phone in Safe Mode if a suspicious application cannot be uninstalled normally. Users can then go to ‘Settings > Apps’, select the suspicious application and uninstall it before restarting the device normally.

As an alternative, users can disable the application's Accessibility access and remove its administrator access under the device's security settings. They should then verify that the application has been removed. If it cannot be removed or returns after a restart, the advisory recommends backing up important data and performing a factory reset.

The NCTAU has asked users to report fraudulent applications or cybercrime incidents immediately through 1930 or the National Cybercrime Reporting Portal.