The National Cybercrime Threat Analytics Unit (NCTAU) has warned of a rise in financial frauds involving malicious Android applications disguised as pornography apps and promoted through Facebook and Instagram advertisements.

The apps, which include Night Play, Reloop, Kyss, Vimo, Rivo, Nexo and Vixa, redirect users from social-media advertisements to websites offering pornographic content, where they are prompted to download an Android APK outside the Google Play Store.

According to the advisory, the apps are mainly promoted through pornography-related advertisements or links on Facebook and Instagram. These ads redirect users to websites that serve pornographic content and prompt them to download an APK from outside the Google Play Store.

The websites are largely associated with “.live” domains, the advisory said.

The malware then asks users to grant accessibility and other sensitive permissions. Once these permissions are enabled, the application can gain control of the device and continue running in the background.