A rise in financial frauds being perpetrated through malicious Android applications masquerading as pornography apps and circulated through Facebook and Instagram advertisements, has been observed by the Home Ministry’s cyber crime arm Indian Cyber Crime Coordination Centre (I4C).These are being circulated through Facebook and Instagram advertisements operating under the names “Night Play”, “Reloop”, “Kyss”, “Vimo”, “Rivo”, “Nexo”, “Vixa” and other similar variants.These applications are primarily distributed through advertisements on Facebook and Instagram, which redirect to websites serving pornographic content, where the user is prompted to download the APK.After installation, the app requests permissions that allow it to install additional applications and by abusing accessibility permission, take control of the users’ device, which may result in financial fraud.Some apps also install a VPN, which may be used to route internet traffic pertaining to malicious/criminal activity. The app may prevent users from uninstalling it through the device settings.Modus operandiDistribution: The malicious application is distributed through pornographic content related advertisements or links majorly on Facebook and Instagram. These ads redirect to phishing websites.Redirection: Advertisements redirect to phishing websites serving pornographic content. Domains of the website majorly belong to “.live”. Users are persuaded to download and install the APK from sources outside the Google Play Store.App update: A secondary package gets downloaded and installed on the pretext of an app update, based on permissions abused by the first, initial app.Abuse of accessibility permission for device takeover: After installation, the application asks users to grant accessibility and other sensitive permissions. Once enabled, the malware gains control of the device and continues to run in the background.VPN installation: Some apps may also install a VPN on the device, thereby routing all internet traffic through attacker-controlled servers. This compromises user’s transmitted data, which may subsequently be exploited for malicious or criminal activities.Unauthorised transactions: Since the malware has the ability to take over the compromised device, installing such apps may lead to financial fraud.Precautions and safety recommendationsInstall applications only from Google Play Store or other trusted app stores.Do not download APK files from advertisements, websites or suspicious links.Do not enable/grant accessibility permission for unknown applications.Review installed applications and remove any application you do not recognise.Keep Google Play Protect enabled and keep your Android device updated.Check your bank account and UPI transactions regularly.Steps to uninstallStep 1:  Start your phone in Safe Mode: Press and hold the Power button. Press and hold. Power off until the Safe Mode option appears.Click OK or Restart in Safe Mode. Wait for the phone to restart. “Safe Mode” will appear at the bottom of the screen.Step 2: Uninstall the app: Open Settings. Go to Apps. Select the suspicious application. Tap uninstall. Remove any other unknown or related applications.Step 3: Restart normally: Restart the phone. The device will exit Safe Mode automatically.