Cyber fraud? Call 1930 · cybercrime.gov.in (opens in a new tab)

Search

Download this guide with its diagrams as a PDF.

What it is

Malware is software designed to harm or spy on you: stealing passwords, reading messages, locking files or taking over your device. It usually arrives through fake apps, APK files shared in chats, cracked software, or attachments in emails.

How it works - and where you can stop itRed boxes show what the attacker does. Green boxes show where you can break the chain.
  1. An unknown app or file arrives: an APK, pirated software or a link
    Stop here: Install apps only from the official app store or official websites.
  2. You install it and allow its permissions
    Stop here: Deny permissions the app does not need, especially SMS and accessibility.
  3. Malware runs quietly in the background
    Stop here: Keep the phone updated. Remove any app that behaves oddly.
  4. It reads SMS, OTPs, the screen and your files
  5. Money is stolen or your files are locked

Common warning signs

  • An app or file sent to you in a chat, asking you to install it outside the official app store.
  • Apps that ask for accessibility, SMS or device-admin permissions without a clear reason.
  • Battery draining fast, the device becoming slow, or unknown apps appearing.
  • Pop-ups, redirects, or messages sent from your number that you did not send.
  • A 'bank', 'KYC', 'electricity bill' or 'RTO challan' app or APK sent by message.

Practical prevention tips

  • Install apps only from the official app store and check the publisher and reviews.
  • Never install APK files received through messages, even from contacts.
  • Keep your operating system and apps updated, and use a reputable security app.
  • Avoid pirated or cracked software.
  • Review app permissions and uninstall anything you do not recognise.
Risky habit vs safe habit
  • Install an APK sent on WhatsApp or Telegram
    Use only the official app stores
  • Use cracked or pirated software
    Use genuine or free open-source software
  • Ignore system and app updates
    Keep your phone and apps updated
  • Never back up your files
    Keep a regular backup, ideally offline as well

What to do if it happens

  1. Disconnect from the internet, uninstall the suspicious app and run a security scan.
  2. Change passwords from a clean device, starting with email and banking.
  3. Contact your bank if the device has banking apps. If needed, back up important data and reset the device.
  4. Report to cybercrime.gov.in, and to 1930 if money was lost.

Official reporting resources

Related educational articles

This website is an educational resource. It is not an official government reporting portal or an emergency response service. If you are a victim of cyber fraud, report it through the official channels listed on each page.