Facebook or Instagram adult-content ad leads to an APK that hijacks your phone and drains your bank
An adult-content ad on Facebook or Instagram redirects to a site where you are asked to download an APK (Night Play, Reloop, Kyss, Vimo, etc.). Once installed, the app abuses Accessibility permissions and installs a hidden VPN to steal OTPs and drain your bank.
Also known as: fake adult app malware India, Night Play Reloop Kyss Vimo malware, porn app APK banking fraud, adult content Facebook ad APK scam, I4C adult app advisory August 2026
Already happened to you? Do this in the next few minutes
Call 1930 now- 1 Call 1930 — the national cyber-crime helpline — right now. The sooner you report, the better the chance of freezing the money before it moves.
- 2 Call your bank to freeze the account and block the card immediately. Use the number printed on your card, never a number from the message or caller.
- 3 File a report at cybercrime.gov.in and keep every message, screenshot, and transaction ID.
- ! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
What to do right now
- 1 Do not install any APK downloaded from a website linked in a social media ad — all legitimate apps are available on the Google Play Store
- 2 If you already installed the app: immediately remove your SIM card, call your bank from a different phone to freeze your account and block UPI
- 3 Revoke Accessibility Services permission for the app immediately: Settings → Accessibility → Installed Services
- 4 Check Settings → Network → VPN and remove any VPN you did not install. If the app blocks removal, a factory reset may be required
- 5 After a factory reset, change all banking PINs, UPI PINs, and net-banking passwords from a clean device before re-inserting your SIM
- 6 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
- 7 Report at https://cybercrime.gov.in or call 1930 (national cyber helpline).
Was remote-access software installed?
If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.
Run SeraphSecure to detect and remove it →Red flags
- ⚠ A Facebook or Instagram ad shows adult content and prompts you to tap — any sponsored adult-content ad leading to an app download is a red flag
- ⚠ The ad redirects to a website (often a .live domain) and asks you to download an .apk file — real apps are installed from the Google Play Store, never from a random website
- ⚠ After installing, the app requests Accessibility Services permission — a media or entertainment app never legitimately needs Accessibility Services
- ⚠ The app may silently install a VPN in the background — check Settings → Network → VPN for any VPN you did not consciously install
- ⚠ OTP alerts arrive on your phone for transactions you did not initiate shortly after installing a new app
Sources
- ANI / I4C — Malicious porn apps targeting users trigger financial fraud: I4C advisory (August 31, 2026)
- Business Standard / MHA — Home ministry flags fraud risk from 'porn apps' advertised on social media (August 31, 2026)
- Honolulu Star-Advertiser / Reuters — Meta removes ads for fraud apps posing as porn after India sounds alarm (August 31, 2026)
- Oneindia — Android Porn App Scam: Fake Apps on Facebook, Instagram Can Hijack Phones, Steal Bank Money (August 2026)
- Amar Ujala — Cyber Crime: Adult apps ke zariye badhe dhokhadhadi ke mamle, Facebook/Instagram par ads se app ka failav (August 31, 2026)
- ETV Bharat — I4C launches awareness drive as fake social media ads become the new cybercrime trap (October 6, 2026)