# Malware campaign targeting Indian users via Meta ads

> Live situation record from CLSTR: https://clstr.news/situations/malware-campaign-targeting-indian-users-via-meta-ads
> Updated: 2026-08-31T16:14:59.000Z. Sources: 11. Developments: 2.

The Indian Ministry of Home Affairs issued an advisory warning Android users about fraudulent advertisements on Facebook and Instagram. These ads promote malicious applications disguised as pornography to lure users into downloading software from outside official app stores.

Identified suspicious applications include ‘Night Play’, ‘Kyss’, ‘Reloop’, ‘Vimo’, ‘Rivo’, ‘Nexo’, and ‘Vixa’. The malware typically directs users to phishing websites to download APK files. Once installed, these apps can request Accessibility permissions, allowing attackers to monitor screens, intercept one-time passwords (OTPs) and bank PINs, and perform unauthorized financial transactions. Some versions may also install a VPN to route traffic through attacker-controlled servers.

In response to government warnings, Meta removed dozens of these advertisements from its platforms. The fraudulent ads utilized sexually explicit content to trick users into downloading malicious Android applications designed to steal banking credentials and empty accounts.

## Timeline

### 2026-08-31: India warns of malicious porn apps on Meta platforms used for financial fraud

India's Ministry of Home Affairs warns of malicious porn apps advertised on Meta platforms that hijack Android phones to steal bank details and intercept OTPs via phishing and unauthorized APK downloads.

9 sources. https://clstr.news/cluster/india-warns-of-malicious-porn-apps-on-meta-platforms-used-for-financial-fraud

### 2026-08-31: Meta removes fraudulent ads targeting users in India

Meta removed fraudulent ads on Facebook and Instagram after Indian authorities warned they were using sexually explicit content to distribute malware designed to steal banking credentials.

2 sources. https://clstr.news/cluster/meta-removes-fraudulent-ads-targeting-users-in-india

---
Cite as: Malware campaign targeting Indian users via Meta ads. CLSTR, https://clstr.news/situations/malware-campaign-targeting-indian-users-via-meta-ads