Night Play, Kyss: MHA warns malicious Android apps, porn being used to steal money

Indian authorities have raised alarms about a growing threat posed by malicious Android applications disguised as adult content apps, which are being used to defraud users of their personal and financial information. The National Cybercrime Threat Analytics Unit (NCTAU), part of the Indian Cyber Crime Coordination Centre (I4C), has warned that these apps are being distributed through deceptive advertisements on social media platforms, leading users to phishing websites where they are prompted to download APK files from outside the Google Play Store. These apps, named Night Play, Reloop, Kyss, Riva, Vima, Nexo, and Vixa among others, are being promoted through misleading Facebook and Instagram ads. Once downloaded, the apps request permissions that allow them to install additional applications, giving fraudsters control over the device and enabling unauthorized financial transactions. Some of these malicious apps also install a virtual private network (VPN), potentially allowing attackers to monitor or manipulate internet traffic related to criminal activities. The advisory from NCTAU highlighted that once installed, these apps seek sensitive permissions, including Accessibility access. If granted, this allows the malware to read information displayed on the screen, click buttons, input one-time passwords (OTPs) or PINs, confirm transactions, and initiate fund transfers. This capability can result in victims' bank accounts being accessed and funds being stolen. In addition to stealing financial information, the malicious applications may also install a secondary application by pretending it is an update to the original app. In some instances, the apps install a virtual private network (VPN), routing the user's internet traffic through servers controlled by attackers. This could expose transmitted data to further misuse, according to the advisory. The apps may also attempt to prevent users from uninstalling them through normal device settings, making removal more challenging. The NCTAU has advised Android users to install applications exclusively from the Google Play Store or other trusted app stores and to avoid downloading APK files promoted through advertisements, suspicious websites, or unknown links. Users have also been advised against granting Accessibility permissions to unfamiliar applications. The cybercrime unit recommended regularly reviewing installed applications and removing those that are not recognized, while keeping Google Play Protect enabled and the Android operating system updated. Citizens were asked to frequently check their bank accounts and UPI transactions for any suspicious activity. For devices already compromised, the advisory suggests restarting the phone in Safe Mode and uninstalling suspicious or unknown applications. Users may also need to disable Accessibility access and remove device administrator privileges granted to malicious apps. If an application cannot be removed or reappears after restarting, users have been advised to back up important data and consider performing a factory reset. The government has urged citizens to report fraudulent applications or cybercrime incidents immediately through the national cybercrime helpline 1930 or the government’s cybercrime reporting portal. These steps aim to mitigate the risks associated with these malicious apps and protect users from falling victim to financial fraud.