Malware Steals OTPs via Windows Phone Link — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 10, 2026

Severity: HIGH | View Full Scam Details

Beware in 2026: Malware Steals OTPs via Windows Phone Link Scam Targets Indian Users

A new high-risk scam in India uses malware exploiting the Windows Phone Link feature to steal your OTPs and drain your bank accounts.

What Is the Malware Steals OTPs via Windows Phone Link?

This cyber scam involves malware that hackers install on your device by tricking you into clicking fake app updates or tools. Once installed, the malware leverages the Windows Phone Link feature—a tool that connects your phone to your Windows PC—to intercept one-time passwords (OTPs). These OTPs are crucial for verifying transactions during online banking and UPI payments. By capturing OTPs, scammers can bypass multi-factor authentication, making it easier to withdraw money or make unauthorized payments from your bank account.

Indian users who rely heavily on smartphones for banking and digital payments are particularly vulnerable. With UPI transactions crossing billions daily, a stolen OTP can lead to quick financial losses. The scam has been reported increasingly in urban centers across India, with CERT-In (Indian Computer Emergency Response Team) issuing warnings related to malware exploiting connectivity features like Phone Link to gain unauthorized access. The RBI has also reiterated the importance of safeguarding OTPs following these emerging threats.

How This Scam Works — Step by Step

1. Initial Contact: Typically, the victim receives a WhatsApp message, SMS, or email claiming to offer a “Windows Phone update” or a “new tool to improve device performance.” This message often appears very convincing and may include links or attachments.

2. Malware Installation: Clicking the link or opening the attachment downloads malware disguised as a legitimate update or software installer. The app requests permissions to access phone and messaging services under normal-looking pretenses.

3. Activation of Phone Link Exploit: The malware uses the Windows Phone Link feature to sync the phone with a connected Windows PC, secretly capturing OTP messages sent to the phone in real-time.

4. Intercepting OTPs: When the victim initiates any transaction requiring OTP verification (such as UPI transfers or net banking), the OTP is instantly intercepted and sent to the scammer’s server.

5. Unauthorized Transactions: Using the captured OTP, scammers complete fraudulent transactions, transferring INR from the victim’s bank account. Since the victim’s device appears to be performing the transaction, multi-factor security is bypassed without triggering alerts.

6. Covering Tracks: The malware may delete transaction SMS notifications or simulate successful operations to keep the victim unaware until it’s too late.

Real Warning Signs to Watch For

• Unexpected messages urging you to download Windows or phone updates via WhatsApp, email, or SMS.
• Links to apps or downloads coming from unverified sources or unknown contacts.
• Requests for excessive app permissions, especially access to SMS, calls, or device syncing tools.
• Decreased phone or PC performance immediately after clicking on suspicious links.
• Missing or delayed OTP SMS notifications for legitimate transactions.
• Unrecognizable UPI or banking transactions appearing on your app or bank statement.
• Inability to access official apps or receiving repeated login prompts unexpectedly.

What Happens to Victims

Victims can face severe financial losses as criminals swiftly transfer funds using stolen OTPs before you realize something is wrong. In India’s context, reversing unauthorized UPI transactions is complicated since payments are instant and final. Additionally, the emotional distress caused by losing money tied to your hard work can be immense.

Worse, the scam can lead to Aadhaar misuse if identity information stored on the phone is accessed, causing longer-term damage such as SIM swap frauds or fake KYC profiles. Victims sometimes face difficulties in restoring accounts and recovering funds due to the technical sophistication of these attacks.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) has issued circulars stating that customers should never share OTPs or banking PINs with anyone, and warned about the rising sophistication of malware that targets authentication methods. RBI also suggests regular monitoring of bank statements and alerts immediate reporting of suspicious transactions.

CERT-In has highlighted malware threats exploiting connectivity tools like Phone Link and has urged users to keep operating systems updated and avoid downloading unofficial software. They emphasize using official app stores like Google Play or Microsoft Store and maintaining endpoint security on both smartphones and PCs.

If you face cyber fraud, you can contact the national cybercrime helpline at 1930 or report incidents at cybercrime.gov.in, which is monitored by the government’s Indian Cyber Crime Coordination Centre (I4C).

How to Protect Yourself

1. Avoid Clicking Unknown Links: Never download apps or updates via WhatsApp, email, or SMS links unless they come from official sources or your device’s app store.

2. Disable Windows Phone Link If Not Needed: Turn off or restrict the Phone Link feature on your PC and phone if you don’t use it regularly.

3. Check App Permissions: Regularly review app permissions, especially for SMS, phone, and syncing functions. Remove suspicious apps immediately.

4. Use Antivirus Software: Install antivirus on both your Windows PC and Android phone to detect and block malware.

5. Never Share OTPs or PINs: Treat OTPs like passwords; do not disclose them to anyone, including bank staff or customer support callers.

6. Keep Software Updated: Always update your devices through official channels to protect against known vulnerabilities.

7. Enable Bank Notifications: Activate transaction alerts via SMS or email to detect any unauthorized activity early.

What to Do If You’ve Been Targeted

• Call your bank immediately to block all transactions and freeze UPI payments.
• Report the fraud to RBI’s banking helpline and your financial institution’s fraud department.
• File a complaint at cybercrime.gov.in providing full details of the scam.
• Contact CERT-In or the 1930 cybercrime helpline for additional assistance and reporting.
• Change all banking and app passwords, and remove any suspicious apps from your devices.
• Monitor your bank account and UPI apps closely for at least a few months following the incident.
• Alert your mobile service provider if you suspect SIM swap attempts following the scam.

Frequently Asked Questions

Q: How can malware steal OTPs through Windows Phone Link?
A: The malware exploits the syncing feature between your phone and PC, intercepting OTP messages as they arrive and sending them to scammers in real time.

Q: Does this scam affect only Windows phone users?
A: No. While the Windows Phone Link feature is targeted, many Android users with linked Windows PCs are at risk if they use this syncing feature.

Q: Can I recover my money if my OTP is stolen?
A: Recovering funds can be difficult because UPI payments are instant, but prompt reporting to your bank and cybercrime authorities improves your chances.

Stay safe by verifying suspicious messages and links with BharatSecure.app — your trusted guide against digital fraud in India. Always double-check before trusting updates or sharing sensitive details!