Meta has removed dozens of Facebook and Instagram advertisements that used sexual content to lure users into downloading malicious Android applications linked to banking fraud and data theft. According to a Reuters report, the removal came after Indian authorities raised concerns about financial fraud targeting the country's rapidly growing digital payments ecosystem. The action follows Meta's advertising policies that prohibit ads containing adult nudity or sexual activity, as well as products or services involving deceptive or misleading practices intended to defraud users of money.
The Indian Cybercrime Coordination Centre (I4C) has issued an urgent advisory about a sophisticated cybercrime campaign targeting social media users through fake adult and dating applications. According to reports from the I4C's National Cybercrime Threat Analytics Unit (NCTAU), cybercriminals are using ads on platforms such as Instagram and Facebook to lure users with sexually explicit content and dating-related offers. These malicious advertisements lead users to download malicious Android applications that can steal sensitive data and commit financial fraud. The I4C's Threat Analytics Unit (TAU) has identified several applications as part of this campaign, including 'Night Play,' 'Reloop,' 'Kyss,' 'Vimo,' 'Rivo,' 'Nexo' and 'Vixa.' The advisory warns that these applications are usually circulated through social media platforms such as Instagram and Facebook in the form of ads and urges users to be cautious when clicking on such advertisements or downloading apps promoted through them.
The fraudulent applications operate through a sophisticated multi-step process that begins with websites serving pornographic content usually having a '.live' domain that persuade users to download APK files from sources other than the Google Play Store. Once downloaded, these applications download another app on the pretext of an update, then request accessibility permission. As reported by the I4C, once accessibility permission is granted, the app abuses the permission and starts controlling the device while running in the background. Some applications download a VPN that directs all internet traffic to scammers' servers, enabling attackers to reroute internet traffic through their own servers and exposing users' data to misuse and fraud. The malicious apps are designed to trick users into downloading APK files from shady websites, with the application asking for sensitive permissions that provide scammers with complete control over infected devices. According to the latest advisory, users may be unable to uninstall these applications as the app may prevent users from uninstalling it through device settings.
India suffered cyber fraud losses of around $2.4 billion in 2025 as scammers increasingly targeted the country's rapidly growing digital payments ecosystem, according to a Reuters report. This represents a significant escalation in cybercrime activities affecting the country's financial infrastructure. The fraudulent apps typically require users to download a file called 'Movexa.apk' directly from outside the official app store, bypassing standard security measures. Users were prompted to download APK files and install them manually on Android devices, where the applications request extensive permissions that provide scammers with complete control over infected devices.
This removal represents the second time in recent weeks that Indian authorities have raised concerns about financial fraud linked to major technology platforms, according to Reuters reports. The I4C has provided specific guidance for users to protect themselves, recommending they avoid downloading APK files from social media ads or unfamiliar websites and instead download applications only from trusted app stores with Google Play Protect enabled. Users should regularly check their list of installed apps and remove anything they do not remember downloading, and ensure they use Google Play Protect with device updates. Additionally, users should never allow suspicious applications with Accessibility access and always double check suspicious applications before uninstalling them. For users who cannot remove malicious applications through standard methods, the I4C recommends two specific removal methods: Method 1 involves restarting the device in safe mode and manually uninstalling the application, while Method 2 requires disabling accessibility permissions and deactivating device administrator access. Users who cannot remove applications should back up important data and perform a factory reset as a last resort.
