Govt Warns Android Users Of Porn Apps On Instagram, Facebook That Can Steal OTPs, Bank PINs

The government has warned Android users about malicious applications disguised as pornography apps and promoted through Facebook and Instagram advertisements. The National Cybercrime Threat Analytics Unit (NCTAU) has observed a rise in financial frauds involving such apps, according to an advisory from the Ministry of Home Affairs.

The apps are circulated under names including “Night Play”, “Reloop”, “Kyss”, “Vimo”, “Rivo”, “Nexo” and “Vixa”, along with other similar variants. Users are directed from social-media advertisements to websites offering pornographic content and are then prompted to download an Android APK from outside the Google Play Store.

Once installed, these apps can request sensitive permissions and misuse Android’s Accessibility feature to gain control of the device. The advisory also warned that some variants may install a VPN, potentially routing internet traffic through servers controlled by attackers.

How The Malicious Apps Take Control

The attack typically begins with an advertisement on Facebook or Instagram that redirects users to a website showing pornographic content. The websites then persuade users to download an APK file rather than installing an app through the Google Play Store.

After the initial installation, a secondary package may be downloaded under the pretext of an app update. The malware can then seek Accessibility and other sensitive permissions from the user.

If Accessibility access is granted, the malicious app can control parts of the device and continue running in the background. According to the government advisory, some of these apps can also make themselves difficult to remove through the phone’s normal settings.

OTPs, Bank PINs And Money At Risk

The government warned that the malware can secretly access information stored on a compromised phone, capture one-time passwords and bank PINs, and potentially transfer money from accounts without the user’s knowledge.

Some variants may also install a VPN and route the device’s internet traffic through attacker-controlled servers. This could expose transmitted information and allow it to be exploited for malicious or criminal activities.

The advisory said users who install such applications could face financial fraud because the malware can take control of the compromised device. Users should therefore avoid downloading APK files from unknown websites, particularly when prompted through social-media advertisements.

How To Remove A Suspicious App

If a suspicious application has already been installed, the advisory recommends restarting the Android phone in Safe Mode and then going to Settings > Apps to uninstall the suspicious app. Users should also remove other unknown or related applications before restarting the phone normally.

If the app cannot be removed, users can check Accessibility settings and disable the suspicious application’s access. They should also check Security or Security & Privacy settings for Device Administrator access and deactivate the suspicious app if it has been enabled.

After removal, users should check their installed apps again. If the suspicious application cannot be removed or returns after restarting, the advisory recommends backing up important data and considering a factory reset.