The National Cybercrime Threat Analytics Unit (NCTAU), functioning under the Ministry of Home Affairs’ Indian Cybercrime Coordination Centre (I4C), has issued a public advisory warning against a surge in financial fraud linked to malicious Android applications masquerading as adult content platforms. Promoted via advertisements on social media platforms like Facebook and Instagram under names such as “Night Play,” “Reloop,” “Kyss,” “Vimo,” “Rivo,” “Nexo,” and “Vixa,” these campaigns lure users to external websites to download third-party Android Package Kit (APK) files outside the official Google Play Store.
The advisory outlines a multi-stage attack chain where the installed malware requests sensitive Android permissions, particularly Accessibility Services, allowing threat actors to remotely hijack the device and operate covertly in the background. Beyond installing secondary malicious packages disguised as routine software updates, certain variants deploy unauthorized Virtual Private Networks (VPNs) to route victim web traffic through attacker-controlled servers. By abusing granted permissions, criminals can read screen contents, capture one-time passwords (OTPs), manipulate device settings to block uninstallation, and execute unauthorized bank transfers or UPI transactions.
To counter the threat, the I4C advises citizens to download applications exclusively from verified app stores, avoid downloading unverified APK files, deny Accessibility permissions to unfamiliar software, and keep Google Play Protect active. For compromised devices, the agency recommends booting into Safe Mode to remove suspicious applications and revoke administrator privileges, or performing a factory reset if persistent malware blocks normal uninstallation. Victims of financial fraud or malicious applications are urged to report incidents immediately via the national cybercrime helpline 1930 or through the official portal at cybercrime.gov.in.
Click Here For The Original Source.
