Malicious porn apps targeting users trigger financial fraud: I4C advisory

New Delhi [India], August 31 (ANI): The National Cybercrime Threat Analytics Unit (NCTAU) under the Indian Cybercrime Coordination Centre (I4C) has warned about a rise in financial frauds involving malicious Android applications masquerading as pornography apps.
The warning was issued through a Ministry of Home Affairs (MHA) under (I4C) advisory issued on August 26, mentioning that these apps are being promoted through advertisements on Facebook and Instagram under names including "Night Play", "Reloop", "Kyss", "Vimo", "Rivo", "Nexo" and "Vixa", besides other variants.
The advisory said the advertisements redirect users to websites offering pornographic content, where they are persuaded to download an APK file from outside the Google Play Store.
Once installed, the malicious applications seek accessibility and other sensitive permissions, which can allow attackers to take control of the device and operate the malware in the background.
The cybercrime unit said a secondary package may subsequently be downloaded under the pretext of an app update. By abusing permissions granted to the initial application, the malware can facilitate device takeover and potentially lead to unauthorised financial transactions.
Some of these applications may also install a VPN on the device, routing internet traffic through attacker-controlled servers. This could compromise users' transmitted data and potentially expose it to malicious or criminal activities. The malware may also prevent users from uninstalling the application through normal device settings.
According to the I4C advisory, the modus operandi involves six stages -- distribution through social media advertisements, redirection to phishing websites, downloading of a secondary package disguised as an app update, abuse of Accessibility permissions for device takeover, installation of a VPN and, ultimately, unauthorised financial transactions.
The NCTAU has advised users to download applications only from the Google Play Store or other trusted app stores and avoid APK files received through advertisements, websites or suspicious links.
Users have also been advised not to grant accessibility permissions to unknown applications, regularly review installed apps and remove those they do not recognise.
The advisory further recommends keeping Google Play Protect enabled, updating Android devices and regularly checking bank accounts and UPI transactions for suspicious activity.
The cybercrime unit has suggested restarting the phone in Safe Mode and then uninstalling the suspicious application.
It is also advised that users should remove other unknown or related applications before restarting the device normally. If the app cannot be removed, users have been advised to disable its accessibility access and remove any administrator privileges granted to it. If the application continues to return after a restart, users should back up important data and consider performing a factory reset.
The advisory urged citizens to report fraudulent applications or cybercrime incidents immediately by calling 1930 or through the National Cybercrime Reporting Portal. (ANI)