Archive · 29 Oct 2025
Cyber Fraudsters Hijack Android Phones Using Malicious APK Files
Imagine someone sends you a special file, like a secret code, on your phone that pretends to be a fun game or an important message.
This file is called an APK.
Normally, you only get these files from safe places like the app store.
But bad guys trick you into downloading these APKs from links they send you, maybe pretending it's for a loan or to avoid your account being closed.
Once you open it, it asks for permission to see your texts, your screen, and other private things.
If you say yes, the bad guys can see all your secret codes, like the ones for your bank, and steal your money.
They can even control your phone!
The police are warning everyone to never open these special files from strangers.
Always get apps from the official store and be careful what you click on.
Cybercriminals are using malicious APK files to compromise Android smartphones and steal money.
These files are disguised as legitimate apps for loans, KYC updates, or delivery confirmations, often using official logos.
Victims download APKs from untrusted sources via links sent through SMS, WhatsApp, or social media.
Upon installation, these apps request sensitive permissions to access SMS (for OTPs), screen activity, and other personal data.
The stolen information is used for financial fraud, including unauthorized transactions and impersonation.
- Who
- Cyber fraudsters and Chandigarh Cyber Police
- What
- A rise in financial frauds where malicious APK files are used to hijack Android smartphones.
- When
- In the past three months (specifically for the Chandigarh complaints).
- Where
- Primarily targeting Android users, with a significant number of complaints originating from Chandigarh, India.
- Why
- To steal banking credentials, OTPs, and gain remote control of devices to conduct financial fraud and other illicit activities.
Victim's Action
Fraudster's Deception
APK File Installation
Victim's Action
Victims are tricked into downloading and installing APK files from suspicious links received via SMS, WhatsApp, or social media, often under false pretenses.
Fraudster's Deception
Fraudsters disguise malicious APKs as legitimate apps for loans, KYC updates, parcel delivery, or rewards, using logos of trusted entities to build credibility.
Granting Permissions
Victim's Action
Victims grant sensitive permissions to the installed APKs without fully understanding the implications.
Fraudster's Deception
Malicious APKs request dangerous permissions like SMS access (for OTPs), screen recording, accessibility services, contact access, camera, and storage.
- Threat Type
- Malicious APK files targeting Android smartphones
- Modus Operandi
- Tricking users into downloading APKs from untrusted sources and granting excessive permissions.
- Examples of Deception
- Fake 'wedding invitations', 'traffic challans', 'court orders', 'loan approval apps', 'KYC updates', 'parcel delivery confirmations', 'cashback/rewards apps'.
- Permissions Sought
- SMS access (OTP theft), screen recording, accessibility services, contacts, camera, storage.
- Consequences
- Hijacking of smartphones, theft of banking credentials, OTP interception, remote device control (RATs), financial fraud, identity theft, device locking for ransom.
- Reporting Channels
- 1930 or cybercrime.gov.in
- Number of Complaints (Chandigarh)
- 185 in the last three months
Sources
Navi Mumbai Cyber Fraud: 36-Year-Old Taloja Man Duped Of ₹7.85 Lakh In Fake Vehicle Challan APK Scam; Uran Police Launch Manhunt
Retired Noida engineer duped of Rs 80 lakh by cyber fraudsters, FIR filed
OTP thefts and privacy breaches: Cyber police issue advisory on call forwarding scams