Android alert: Govt warns of malicious adult-content apps promoted on Instagram, Facebook

The Indian government has alerted Android users to a new round of malicious apps disguised as pornography apps. These apps are supposed to be advertised on Facebook and Instagram, but they can take hold of users' smartphones and facilitate financial fraud.

The National Cybercrime Threat Analytics Unit (NCTAU) of the Indian Cyber Crime Coordination Centre (I4C) and the Ministry of Home Affairs issued the warning. During its advisory, the agency named several apps, including Night Play, Reloop, Kyss, Vimo, Rivo, Nexo and Vixa.

How the malicious apps reach users

The attack begins with ads or links to pornography on Facebook and Instagram, the NCTAU advisory said. These ads can take users to websites containing adult material and request them to install an APK for Android.

Many of these sites have “.live” domains, the advisory said. The APKs are downloaded outside of Google Play, meaning that a user will not go through the security checks of a regular app store.

Once installed, the first app will install another package in the guise of an update. The malware can then request user permissions, such as Android Accessibility.

Apps can take control of Android phones

“Accessibility” is a function that can be abused, meaning there is potential for harmful programmes to take control of portions of the device, said NCTAU. This may enable the attacker to control the phone remotely, leave malware running in the background, and even make unauthorised financial transactions.

Some types of malware may also install a virtual private network (VPN). This may cause the phone's Internet connection to pass through servers controlled by the attacker, exposing information sent from the phone, the agency said.

The advisory also stated that some malicious applications might make it harder for users to remove them from their devices, even by using the regular device settings.

Government's safety recommendations

NCTAU has issued a warning to Android users to install applications on trusted app stores, including the Google Play Store. Users are not allowed to install APK files from advertisements, websites or dubious links.

The agency has also urged users not to give accessibility access to unknown apps. It suggests keeping Google Play Protect enabled, installing the latest Android updates, and regularly checking bank accounts and UPI transactions.

What to do if a suspicious app is installed

If you can't remove the unwanted app normally, NCTAU suggests restarting the phone in Safe Mode. The user will then be able to go to Settings > Apps, pick an unknown app and remove it.

It can also be turned off or denied access to the phone's security, and its administrator can be removed from the permissions list in the security settings. If the app still does not remove or reappear after restarting the machine, NCTAU suggests backing up any important data and factory resetting the machine.

The I4C advises individuals to contact 1930 or the National Cybercrime Reporting Portal when they come across a fraudulent app or they experience a cybercrime incident.