MHA warns of malicious ‘pornography’ apps that can hijack Android phones, enable financial fraud | #cybercrime | #infosec | #cybersecurity | #hacker

The National Cybercrime Threat Analytics Unit has warned of a rise in financial frauds involving malicious pornography apps circulated through social media advertisements, which can take control of Android devices and potentially enable unauthorised financial transactions.

The malicious apps, disguised as pornography applications and operating under names such as “Night Play”, “Reloop”, “Kyss”, “Vimo”, “Rivo”, “Nexo” and “Vixa”, are being distributed through advertisements and links on Facebook and Instagram, according to the unit.

The unit functions under the Integrated Cybercrime Coordination Centre (I4C), the Union Home Ministry’s anti-cybercrime agency.

According to the advisory, users clicking on the advertisements are redirected to phishing websites offering pornographic content. The websites, whose domains mainly end in “.live”, then persuade users to download APK files from outside the Google Play Store.

Once installed, the apps request permissions that can allow them to install additional applications and abuse Android’s Accessibility feature to take control of the device. This could enable financial fraud, the advisory said.

Some of the malicious applications also install a VPN, which could be used to route internet traffic associated with malicious or criminal activity.

The malware may also prevent users from uninstalling the application through normal device settings, making it difficult for victims to regain control of their phones.

Authorities have advised Android users to download applications only from Google Play or other trusted app stores and avoid installing APK files received through advertisements, websites or suspicious links.

Users have also been asked not to grant Accessibility permissions to unknown applications and to regularly review installed apps and remove those they do not recognise.

The cybercrime unit recommended keeping Google Play Protect enabled and Android devices updated. It also advised users to regularly monitor their bank accounts and UPI transactions for any unauthorised activity.

(With inputs from PTI)