I4C Warning: Fake Android Apps and WhatsApp-Hijack ZIP Files -

Quick answer: India’s Indian Cyber Crime Coordination Centre (I4C) has warned about two scams in recent weeks: fake Android apps advertised on Facebook and Instagram that take over your phone through Accessibility permissions, and booby-trapped ZIP files sent on WhatsApp that hijack WhatsApp Web on Windows PCs. The fix for both is the same habit: never install apps or open files that arrive through ads or messages, and check what has access to your phone and your WhatsApp.

Neither scam needs your OTP or UPI PIN up front. Instead, the criminals get you to install something, and the malicious software does the rest. That’s why these warnings matter even if you already know never to share an OTP.

Below is what each advisory says, written in plain language, along with the settings to check today. Details are as of 5 October 2026.

Warning 1: fake “adult” apps that take over Android phones

On 26 August 2026, I4C’s National Cybercrime Threat Analytics Unit warned that fraudsters are promoting malicious Android apps through ads on Facebook and Instagram, as reported by ANI via Kalinga TV and The NewsMill. The apps pose as adult-content apps under names such as Night Play, Reloop, Kyss, Vimo, Rivo, Nexo and Vixa, and new variants keep appearing.

The advisory describes the attack in six stages, summarised here so you can spot it early:

An ad on social media leads you to a website.
The website asks you to download an APK file, which is an app installed from outside the Play Store.
Once installed, the app downloads a second package, disguised as an “update”.
It asks for Accessibility permission and other sensitive permissions.
With that access, the attackers control the phone in the background and route traffic through a VPN they control.
They then carry out unauthorised financial transactions.

The key step is number four. Accessibility permission is meant for tools that help people with disabilities use their phone, so it can read the screen and tap buttons on your behalf. In the wrong hands, that means an app can see your banking screens and approve actions as if it were you.

What I4C recommends

Install apps only from the Google Play Store or other trusted stores, never from APK links in ads or messages.
Don’t grant Accessibility permission to any app you don’t fully trust.
Keep Google Play Protect turned on and keep your phone updated.
Review your installed apps regularly and remove anything you don’t recognise.
Watch your bank and UPI transactions for anything unusual.
If you think your phone is infected, restart it in Safe Mode, uninstall the suspicious app and, if needed, factory reset it.

Warning 2: ZIP files that hijack WhatsApp and fuel “boss scams”

The second warning is aimed at people who handle money at work, but anyone who uses WhatsApp on a Windows computer should pay attention. I4C first flagged it on 22 June 2026 and issued an expanded alert on 7 August 2026 through the Press Information Bureau.

Here’s how it works, according to I4C:

You receive a ZIP file over WhatsApp, SMS or email with an official-sounding name such as “Statement of Account.zip”, “RBI.zip” or “MCA.zip”.
The ZIP contains a malicious program. When opened on a Windows PC, it installs malware that takes over the WhatsApp Web session and spreads itself to your contacts.
The criminals then pose as a company director or senior executive and tell finance staff to transfer money urgently. This is the “boss scam”.

I4C says it is chiefly targeting chartered accountants, company directors, CFOs and finance staff. In the August update, it said more than 58,000 potential victims had been alerted by SMS from the sender header I4CMHA-G, and that threat information had been shared with CERT-In, Microsoft and Indian antivirus companies.

The simple rule from the June advisory is worth remembering: regulators don’t send software over messaging apps. A real bank statement or RBI notice will never arrive as a program you have to run.

How to check your phone and WhatsApp right now

These checks take about five minutes and cover both scams.

Check which Android apps have Accessibility access

Open Settings and search for Accessibility.
Look under Downloaded apps or Installed apps (the wording varies by brand).
Any app you don’t recognise, or that has no good reason to control your screen, should be switched off and uninstalled.

Confirm Google Play Protect is on

Google’s Play Protect help page says it’s on by default and also checks apps installed from outside the Play Store. To confirm:

Open the Play Store and tap your profile picture.
Tap Play Protect, then the settings icon.
Make sure Scan apps with Play Protect is turned on.

Log out of unknown WhatsApp linked devices

In WhatsApp, open Settings (on iPhone) or the three-dot menu (on Android).
Tap Linked devices.
Tap any computer or browser you don’t recognise or no longer use, and choose Log out.

While you’re in WhatsApp settings, turn on two-step verification under Account. It adds a PIN that’s needed when your number is registered on a new phone.

If you’re a business owner or work in finance

The boss scam works because people trust a familiar name in a chat. I4C’s advice is to change the process, not just to “be careful”:

Never treat a WhatsApp, email or Teams message alone as approval to move money.
Confirm any urgent payment request with a voice call to a number you already have saved, not one given in the message.
Require two people to approve large payments.
On office PCs, block programs from running out of downloaded ZIP files, and keep antivirus software updated.

Small businesses are an easy target because one person often handles everything. A rule as simple as “no transfer without a phone call” stops most of these attempts.

What to do if you’ve already been hit

Speed matters. Call the national cybercrime helpline 1930 or file a complaint at cybercrime.gov.in as soon as you notice money missing, and call your bank to block cards and UPI. Our step-by-step guide on what to do if you’ve lost money to online fraud covers the order to do things in and your rights under RBI rules.

If you suspect an infected phone, disconnect it from the internet before you log in to anything else, and change your banking and email passwords from a different, clean device. For more practical guides, see our Cybersecurity and Privacy section.

Frequently asked questions

Is it ever safe to install an APK file?

Some legitimate apps are distributed as APKs, but an APK link from a social media ad or a stranger’s message is a major red flag. For banking, UPI and anything involving payments, install only from the Play Store, and check the developer name before you tap Install.

How do I know if an app is misusing Accessibility permission?

Warning signs include the screen moving or tapping on its own, a sudden drop in battery life, apps you don’t remember installing, and bank alerts for payments you didn’t make. Go to Accessibility settings and turn off any unfamiliar app straight away.

Does the WhatsApp ZIP malware affect phones?

According to I4C, the malware in this campaign activates only on Windows computers, where it hijacks the WhatsApp Web session. Your phone’s WhatsApp account is still exposed through that linked session, so log out of unknown linked devices.

I got an SMS from I4CMHA-G. Is it real?

I4C said in August 2026 that it had sent alerts to potential victims from the header I4CMHA-G. Even so, don’t click links in any unexpected SMS. If you’re worried, call 1930 directly.

I4C Warning: Fake Android Apps and WhatsApp-Hijack ZIP Files