The National Cybercrime Threat Analytics Unit (NCTAU) has warned about a rise in financial frauds linked to malicious Android applications disguised as pornography apps.
The apps are mainly being promoted through advertisements on Facebook and Instagram under names such as ‘Night Play’, ‘Reloop’, ‘Kyss’, ‘Vimo’, ‘Rivo’, ‘Nexo’ and ‘Vixa’, among other variants.
The advertisements redirect users to websites offering pornographic content and persuade them to download an APK (Android package kit) file. Once installed, the app seeks sensitive permissions, including Accessibility access, which can allow the malware to take control of the device and potentially facilitate financial fraud. Some of the apps may also install a VPN and route the user’s internet traffic through attacker-controlled servers, potentially exposing data.
What does the malware do?
Malicious apps are mainly promoted through advertisements and links related to pornographic content on Facebook and Instagram. These ads redirect users to phishing websites. The websites offer pornographic content and ask users to download an APK file from outside the Google Play Store. Many of the domains reportedly use the “.live” extension.
After installation, the first app may download a second malicious package by presenting it as an app update. This is done by abusing the permissions granted to the initial app. The app asks users to grant Accessibility and other sensitive permissions. Once enabled, the malware can gain control of the device and continue running in the background.
Some apps may install a VPN, allowing attackers to route internet traffic through their servers. This could compromise data transmitted from the device and expose it to further misuse.
With control of the compromised device, the malware may be used to facilitate unauthorised transactions and other financial frauds. Some apps may also prevent users from uninstalling them through normal device settings.
How can users stay safe?
Download apps only from the Google Play Store or other trusted app stores. It also advised that do not download APK files from advertisements, websites or suspicious links. At the same time, never grant accessibility permission to an unknown application. People should regularly check installed applications and remove those that are not recognised. It also advised that keep Google Play Protect enabled and update the Android device regularly. Also, people should check bank accounts and UPI transactions regularly for unauthorised activity.
How to remove the malicious app?
To remove the malicious app, users can restart their phone in Safe Mode by pressing and holding the Power button and then pressing and holding Power Off until the Safe Mode option appears. Select OK or Restart in Safe Mode. Once the phone restarts, open Settings, go to Apps, select the suspicious application and tap Uninstall. Users should also remove any other unknown or related applications and then restart the phone normally to exit Safe Mode.
If the app cannot be removed open the Settings, go to Accessibility and select Installed Services or Downloaded Apps. Then disable Accessibility access for the suspicious application. Users should also open Settings, go to Security or Security & Privacy and select Device Admin Apps or Device Administrators. If the suspicious app has administrator access, deactivate it. Then go to Settings, open Apps and confirm that the suspicious application has been removed. If the app cannot be removed or returns after restarting the phone, users should back up their important data and consider performing a factory reset.