Fake porn apps on Android flagged as new vector for financial fraud

The National Cybercrime Threat Analytics Unit (NCTAU), operating under the Ministry of Home Affairs' Indian Cyber Crime Coordination Centre (I4C), has issued an advisory warning of a surge in financial frauds linked to malicious Android applications disguised as pornography apps.

The apps, circulated under names such as 'Night Play', 'Reloop', 'Kyss', 'Vimo', 'Rivo', 'Nexo' and 'Vixa', are primarily distributed through advertisements on Facebook and Instagram. These ads redirect users to websites hosting pornographic content, where they are prompted to download an APK (Android Package Kit) file.

Once installed, the app requests permissions that allow it to install additional applications. By abusing accessibility permissions, it can take control of the user's device, potentially leading to financial fraud. Some variants also install a VPN to route internet traffic for malicious activity. The advisory notes that the app may prevent users from uninstalling it through device settings.

The advisory urges citizens to avoid sharing sensitive information such as OTPs, PINs, passwords, CVV numbers, or banking credentials. It cautions against clicking suspicious links, downloading unknown apps, or responding to urgent calls and messages about bank accounts, KYC updates, parcels, rewards, or government schemes.

Officials have repeatedly warned that fraudsters impersonate police officers, bank staff, courier executives, or government officials to pressure victims into transferring money or granting remote access. The advisory advises verifying such claims through official channels and avoiding panic-driven actions.

Users are advised to use strong passwords, enable two-factor authentication, keep devices and apps updated, and download applications only from trusted sources. Caution is also advised while scanning QR codes, accepting unknown video calls, or making payments to unfamiliar accounts.

Victims of online fraud are urged to report incidents immediately to the national cybercrime helpline at 1930 or through the official portal at cybercrime.gov.in. Timely reporting can help block fraudulent transactions and assist investigation agencies.