Malicious APK Files & Fake Apps
Criminals distribute Android installation files (.apk) on WhatsApp disguised as wedding cards, traffic challans, or rewards. Once installed, they read your SMS and siphon bank OTPs.
At a Glance
What is it?
What is it?
An APK (Android Package Kit) is the file format used to distribute and install apps on the Android operating system. When you install apps through the Google Play Store, Google scans them for viruses and malware. However, downloading raw .apk files directly from WhatsApp or browser links (“sideloading”) completely bypasses these security scans, allowing attackers to install banking trojans on your device.
The Single Rule for App Downloads
Never install an app from a chat message. Genuine organizations, banks, traffic police departments, and wedding planners distribute information via web pages or official app stores, never through raw .apk file attachments.
How it Works (Step by Step)
Written from the victim's perspective to help you spot each stage before damage occurs.
- 1Step 1: Scammers send an enticing or alarming message with an attached file ending in '.apk' on WhatsApp.
- 2Step 2: You tap the file, and your phone prompts you to enable 'Install from unknown sources'.
- 3Step 3: Once installed, the malware requests sensitive system permissions (READ_SMS, RECEIVE_SMS, Accessibility).
- 4Step 4: The malware establishes a silent background connection to a command-and-control server operated by criminals.
- 5Step 5: When the scammer initiates money transfers, the malware reads the incoming bank OTP, forwards it to the hacker, and suppresses the notification.
Red Flags to Watch For
- Any file ending in '.apk' received over WhatsApp, Telegram, or SMS.
- Messages disguised as 'Wedding_Invitation.apk', 'e-Challan_Notice.apk', or 'Bank_Rewardz.apk'.
- Your Android phone displaying a warning: 'Do you want to install unknown apps from this source?'.
- The app requesting permissions to read SMS messages, access your contacts, or draw over other apps upon installation.
- Your mobile phone suddenly stops showing incoming SMS messages while banking apps exhibit unexpected activity.
Example (made up): The 'Wedding Invitation' APK Malware
Fictional Scenario"Meena received a WhatsApp message from an old acquaintance: 'Please join our daughter's wedding! Tap to see the digital card: Wedding_Card.apk'. Meena tapped the file, bypassed Android's unknown-app warning, and installed it. The screen blinked, but no wedding card appeared. Within two hours, Rs 85,000 was debited across four transactions. The malicious app had intercepted her incoming bank OTPs, forwarded them to the scammer, and deleted the notification alerts from her notification bar."
Why this was a trap:
- ⚠️Wedding card as .apk -> Invitations are PDF files or web links, never executable Android packages.
- ⚠️Android security warning -> The operating system flags unverified apps; overriding it removes sandbox protection.
- ⚠️Hidden SMS alerts -> Banking trojans hide or delete SMS notifications to delay victim discovery.
What to Do
- ✓Install apps ONLY from the official Google Play Store or Apple App Store.
- ✓Keep 'Install unknown apps' disabled in your Android security settings.
- ✓If an APK was installed by mistake, turn off Wi-Fi and mobile data immediately to cut off the attacker's remote connection.
- ✓Uninstall the rogue app in Android Safe Mode and contact your bank to freeze net banking.
What NOT to Do
- ✕Do NOT download or open any file ending in '.apk' sent via chat, even if sent from a friend's compromised account.
- ✕Do NOT grant 'SMS' or 'Accessibility Service' permissions to utility or invitation apps.
- ✕Do NOT ignore Android Play Protect security warnings.
- ✕Do NOT forward suspicious APK files to other family members or groups.
If It Already Happened: Immediate Steps
View Full Emergency Flow- 1Disconnect immediately: Turn on Airplane Mode and disconnect from all Wi-Fi and mobile data networks to sever remote control.
- 2Call 1930 immediately: Report the unauthorized debits from another phone.
- 3Call your bank from another phone: Block all debit cards, credit cards, and freeze net banking access.
- 4Boot into Safe Mode: Uninstall the rogue app from Android Settings -> Apps. If uncertain, perform a full factory reset.
💬 Tell Your Family (WhatsApp Message)
< 60 wordsAPK Warning: Never install any file ending in '.apk' sent over WhatsApp (like wedding cards or challans). They contain malware that secretly reads your bank OTPs and drains your savings. Only download apps from the Google Play Store.
Related Scams
Phishing, Smishing & Fake KYC Scams
Urgent SMS messages warning of bank account blocks, electricity disconnection, or pending traffic challans trick victims into entering OTPs on lookalike fake websites.
UPI & QR Code Fraud
Scammers abuse QR codes and UPI collect requests, tricking you into believing you must enter your UPI PIN to receive a payment or refund. Entering a PIN always sends money.
Verified Primary Sources & Evidence
Facts verified on: 2026-10-22- CERT-In Cyber Security Advisory on Android Banking Trojans Disguised as Utility AppsPublisher: Indian Computer Emergency Response Team (CERT-In) (primary source)Accessed 2026-10-22