MHA warns of fake porn apps that can take over your phone
The National Cybercrime Threat Analytics Unit (NCTAU) of the Indian Cyber Crime Coordination Centre under the Ministry of Home Affairs (MHA) has warned of a sharp rise in financial fraud via fake Android applications that pose as pornography apps. In its advisory dated 26 August 2026, the unit lists applications such as Night Play, Reloop, Kyss, Vimo, Rivo, Nexo, Vixa, and others.
The applications are mainly promoted via paid advertisements on Facebook. These apps are mostly advertised through paid ads on Facebook and Instagram. When someone clicks on an ad for adult content, they are sent to a website that shows pornographic videos and then asks them to download the APK right away. These sites often use ".live" domains, and because the file is not from the Google Play Store, users must allow installation from unknown sources. It then asks for additional packages, a request often framed as a required update.
The important step then comes when the malware asks the user to grant Accessibility services, a powerful Android feature intended to assist people with disabilities. After this permission is granted, the application can read everything on the screen, click buttons, enter OTPs and PINs, confirm payment screens, and initiate fund transfers.
Victims can lose all the money in their bank accounts, even though their phones appear to work normally. Sometimes these apps also force a VPN connection, routing all internet traffic through servers controlled by attackers. Like other similar apps, they often block standard uninstallation methods, so they remain on the device even when the user tries to remove them in Settings.
The attack usually happens in this order: a social media ad, redirection to an adult website, installation of a sideloaded APK, installation of more malware, VPN activation, control of the Accessibility feature, silent control of the device, and then unauthorised UPI or banking transactions. NCTAU advises that you should only download apps from the Google Play Store or other official stores, and never accept APK files from ads, random websites, or unknown links.
You should never grant accessibility permissions to an app you don't know. It's important never to grant accessibility permissions to apps you do not recognise. Regularly check your Settings, review all installed apps, and remove any you do not know. Keep Google Play Protect turned on and make sure your phone's operating system is up to date. Check your bank statements and UPI records often. If you think your phone is infected, there are two ways to remove the malware. Hold down the power button until the Safe Mode option shows up, select it and then wait for the phone to restart, at which point 'Safe Mode' will appear at the bottom of the screen. In Settings, go to Apps, select the suspicious application, then tap Uninstall. Also remove any other unknown applications or those related to it. Finally, restart the phone normally; Safe Mode will then automatically exit.
The second method starts by restoring your original home screen launcher, such as System Launcher, One UI Home, or Pixel Launcher. Next, go to Settings, tap Accessibility, find the malicious app under Installed Services or Downloaded Apps, and turn off its Accessibility option. Then, go to Security or Security & Privacy, select Device Admin Apps or Device Administrators, choose the same app, and tap Deactivate.
After you finish these steps, open your Apps list to make sure the program has been removed. If it returns after you restart your device, save your important data, then perform a factory reset. If you lose money or find a fake app, report it immediately to the national helpline at 1930 or visit www.cybercrime.gov.in.
This scam happens because many people in India download apps from unofficial sources, and the Accessibility API can be misused. With UPI so common, it enables quick and often hidden theft. Cyber-fraud groups often use social media to trick people, so it is important to stay alert when installing new apps.
