Fake Porn Apps Target Android Users Via Ads On Facebook, Instagram: How To Stay Safe

New Delhi: Cybercriminals are reportedly targeting Android users for financial fraud through malicious applications disguised as pornographic apps and promoted via advertisements on Facebook and Instagram. The National Cybercrime Threat Analytics Unit (NCTAU), operating under the Union Home Ministry’s Indian Cyber Crime Coordination Centre (I4C), flagged the trend, following which Meta removed dozens of such sexually explicit advertisements.

According to the agency, the ads were designed to lure users to phishing websites or trick them into downloading malware capable of stealing banking credentials and draining their bank accounts. The I4C advisory also identified several malicious apps as part of the threat, which include the likes of “Night Play”, “Reloop”, “Kyss”, “Vimo”, “Rivo”, “Nexo”, “Vixa”, and other similar variants.

How the Scam Works

According to the I4C advisory, cybercriminals promote these malicious apps through pornography-related advertisements and links on Facebook and Instagram. When users click on these ads, they are redirected to websites offering pornographic content. These sites then ask users to download an Android app, usually as an APK file.

The APK is not downloaded from the Google Play Store. Instead, users are asked to install it directly from the website. The advisory said many of the websites involved use “.live” domains.

After the first app is installed, users may be asked to download another package that appears to be an app update. This second package can take advantage of permissions already granted to—or misused by—the first app.

As per the advisory, the malicious app may ask users to enable Accessibility Services and other sensitive permissions. If granted, these permissions can give the malware extensive control over the device, allowing it to operate in the background without the user's knowledge.

Some versions of the malware may also install a VPN on the device, the advisory claimed, suggesting this could allow attackers to route the user's internet traffic through servers they control, potentially exposing transmitted data to misuse.

Once attackers gain control of the device, they may be able to access sensitive information and potentially carry out fraudulent banking or UPI transactions. The suspected chain of attack is:

Social media ad → Malicious website → APK download → Fake update → VPN/Accessibility permissions → Device takeover → Possible unauthorised financial transactions.

How to protect yourself

• Whenever possible, download Android apps from the Google Play Store or other trusted app stores.
• Avoid installing APK files sent through advertisements, random websites or suspicious links.
• Never give Accessibility access to unknown apps as such permissions can give an app significant control over your device.
• Regularly check the apps on your phone and remove anything you don't recognise or no longer use.
• Keep Google Play Protect enabled and install the latest Android security updates as soon as they arrive
• Keep an eye on your bank and UPI accounts for anything unusual. If you spot an unauthorised transaction, report it to your bank and the appropriate cybercrime authorities immediately.

What to do if you can't uninstall the suspicious app

1. Try Safe Mode: If a suspicious app won't uninstall normally, restart the Android device in Safe Mode. Then go to Settings → Apps and try removing the app.
2. Remove Special Permissions: Before uninstalling the app, you may need to disable its Accessibility access and revoke any administrator privileges it has.16. Factory-reset the phone as a last resort
3. Factory Reset: If the suspicious app cannot be removed or comes back after restarting the device, back up your important data and perform a factory reset.