Government sounds alarm, ads on Facebook and Instagram found directing users to apps that steal banking passwords and remotely control users’ phones
The government has warned of malicious porn apps on Instagram and Facebook that can completely take over Android phones. In an advisory, National Cybercrime Threat Analytics Unit (NCTAU) said that it has observed a rise in financial frauds perpetrated through malicious Android apps masquerading as pornography apps, circulated through Facebook and Instagram ads. As per the Ministry of Home Affairs advisory, these Android apps are operating under the names “Night Play”, “Reloop”, “Kyss”, “Vimo”, “Rivo”, “Nexo”, “Vixa” and other similar variants.These apps are primarily distributed through advertisements on Facebook and Instagram, which redirect to websites and apps showing pornographic content, where the user is prompted to download an APK file. After installation, the app requests permissions that allow it to install additional apps and by misusing accessibility permission, take control of the users’ device. Some apps also install a VPN, which may be used to route internet traffic pertaining to malicious/criminal activity. As per government warning, these apps can secretly access information stored on users’ phones, capture one-time passwords and bank PINs, and transfer money from accounts without the owner’s knowledge. Not just this, the apps also make it difficult for users to uninstall them through device’s normal settings.
How these apps work, spy and steal
Distribution: The malicious apps are distributed through pornographic content related advertisements or links majorly on Facebook and Instagram. These ads redirect to phishing websites.Redirection: Ads redirect to phishing websites serving pornographic content. Domains of the website majorly belong to “.live”. Users are persuaded to download and install the APK from sources outside the Google Play Store.App Update: A secondary package gets downloaded and installed on the pretext of an app update, based on permissions abused by the first, initial app.Abuse of Accessibility Permission for device takeover: After installation, the app asks users to grant Accessibility and other sensitive permissions. Once enabled, the malware gains control of the device and continues to run in the background.VPN Installation: Some apps may also install a VPN on the device, thereby routing all internet traffic through attacker-controlled servers. This compromises user’s transmitted data, which may subsequently be exploited for malicious or criminal activities.Unauthorized Transactions: Since the malware has the ability to take over the compromised device, installing such apps may lead to financial fraud.
How to uninstall these apps
METHOD 1: Safe Mode RebootStep 1: Start Your Phone in Safe Mode: Press and hold the Power button. Press and hold Power Off until the Safe Mode option appears. Click OK or Restart in Safe Mode. Wait for the phone to restart. “Safe Mode” will appear at the bottom of the screen.Step 2: Uninstall the App: Open Settings. Go to Apps. Select the suspicious application. Tap Uninstall. Remove any other unknown or related apps.Step 3: Restart Normally: Restart the phone. The device will exit Safe Mode automatically.Second MethodStep 1: Restore the Default Home Screen (If required): Open Settings. Go to Apps → Default Apps → Home App. Select your phone’s original launcher (System Launcher, One UI Home, Pixel Launcher, etc.).Step 2: Disable Accessibility Access: Open Settings. Tap Accessibility. Open Installed Services or Downloaded Apps. Select the suspicious application. Turn Accessibility Off.Step 3: Remove Administrator Access: Open Settings. Go to Security or Security & Privacy.Open Device Admin Apps or Device Administrators. If the suspicious app is enabled, select it. Tap Deactivate or Turn Off.Verify the Device: Open Settings > Apps. Confirm that the suspicious application has been removed. If the app cannot be removed or returns after restarting, back up your important data and perform a Factory Reset.
