Government warns Android users of malware hidden in social media ads

MUMBAI: The bait may look tempting, but the real catch is hiding in the download. The government has warned Android users about a malware campaign being pushed through Instagram and Facebook ads, with malicious applications disguised as pornographic or adult-content apps.

According to the National Cyber Threat Analytics Unit (NCTAU), some of these apps can install a VPN on a victim’s phone, potentially allowing attackers to route the device’s internet traffic through servers under their control. This could expose data being transmitted from the device and create further security risks.

The threat begins with a familiar social media trap. Users searching for adult content may encounter advertisements that direct them to download an application, often from outside the official Google Play Store. Once installed, the app can request extensive permissions and gain access to sensitive parts of the device.

The ability to install a VPN makes the campaign particularly concerning. If attackers control the VPN connection, traffic from the affected phone could potentially be monitored or redirected, putting information transmitted from the device at risk.

The danger is not limited to data exposure. The government warning also points to the possibility of financial fraud, as malicious Android applications can potentially access sensitive information, intercept communications or facilitate unauthorised transactions.

The risk increases when users grant unfamiliar apps broad permissions simply to unlock the content they promise. An application downloaded outside an official app store can therefore turn a moment of curiosity into a much bigger cybersecurity problem.

Android users are advised to avoid downloading APK files promoted through social media advertisements or unfamiliar websites, particularly when the application is not available through an official app store.

Users should also avoid granting unnecessary permissions to apps and keep their Android operating system and security software updated.

Anyone who has already installed a suspicious application should remove it and check the device for unusual activity. If unauthorised financial transactions are detected, users should immediately contact their bank and report the incident through India’s cybercrime helpline, 1930.

The warning underlines a simple digital safety lesson: the riskiest part of the advertisement may not be what it promises, but the app it persuades you to install.