The Ministry of Home Affairs (MHA) on Monday issued an advisory against rising financial fraud involving malicious Android apps that were found to be masquerading as pornography apps. According to the National Cybercrime Threat Analytics Unit (NCTAU), the apps are being promoted under various names through advertisements on social media platforms under Meta Platforms’ umbrella. Once installed, the malicious apps are capable of providing threat actors with extensive control over an affected device.
Advisory Against Malicious Android Apps
The government specifically named Night Play, Reloop, Kyss, Vimo, Rivo, Nexo and Vixa in its advisory, while warning that similar variants of the apps may also be used to distribute the malware.
According to the MHA advisory, users who click on these ads may be redirected to websites offering adult content, where they are encouraged to download an APK file to access the material. Some of these applications can download additional packages by presenting them as app updates. They may also install a VPN that routes the user’s internet traffic through servers controlled by attackers.
The govt said that the biggest risk was when some of the apps request for Accessibility permission. While it was originally designed to legitimate apps assist users with disabilities, malicious software can abuse it to gain extensive control over a device. According to the MHA, this could potentially allow attackers to carry out financial fraud.
The Ministry has advised users against downloading APK files through advertisements, websites or suspicious links. It recommends installing apps only through the Google Play Store or other trusted app stores.
There may be cases when the malicious app prevents users from uninstalling it through the device settings. The govt has therefore advised users to check their devices and ensure that any suspicious application has been removed. If an app cannot be removed or returns after the device is restarted, users have been advised to back up important data and perform a factory reset.
Separately, Reuters reported that Meta Platforms has removed dozens of advertisements from Facebook and Instagram after India raised concerns about the campaign. The report claims that at least 39 such advertisements were still active after the govt issued its advisory on Monday.
Meta, however, subsequently removed the ads after Reuters flagged them to the company. Notably, the social media giant’s advertising policies prohibit ads containing adult nudity and sexual activity, as well as advertisements involving deceptive or misleading practices intended to scam users.
