APK-Based Remote Access Trojan (RAT) Scam
एकेपी-आधारित रिमोट एक्सेस ट्रोजन घोटाला
INDIA — By BharatSecure Threat Intelligence Team ·
Verdict: Dangerous | Risk Score: 10/10 | Severity: Critical
Category: KYC
Scam Intelligence: APK-Based Remote Access Trojan (RAT) Scam
Proprietary signals from BharatSecure's scam-tracking database.
| Last reported | Apr 16, 2026 |
| First documented | Apr 16, 2026 |
How APK-Based Remote Access Trojan (RAT) Scam Works
- Scammer poses as bank (SBI/HDFC) or Electricity Board (KYC/Bill update).
- Sends a direct link to download a 'Support App' via .APK file.
- App requests 'Accessibility Services' permissions.
- Attacker gains full control, hides SMS notifications, and bypasses 2FA.
How This Scam Works — Detailed Explanation
In India, many digital services like UPI payments, Aadhaar verification, and mobile banking require KYC (Know Your Customer) verification. Scammers exploit this by creating fake KYC apps disguised as official ones, often shared outside of the Google Play Store as APK files. These fake apps are actually Remote Access Trojans (RATs) that allow hackers to take full control of your phone once installed.
The scam usually begins with a message or WhatsApp forward claiming that your bank or UPI app requires urgent KYC update via a new app named something like "CustomerSupport.apk". The victim is asked to download the APK file from a suspicious link—never from the Play Store. After installation, the app requests 'Accessibility Service' permission, which is a powerful access allowing the app to read your screen, capture OTPs, and perform actions without your knowledge.
To avoid suspicion, the app tricks users by showing a black screen during an 'update process' while running hidden commands in the background. With granted permissions, scammers can read incoming OTPs, view WhatsApp messages, or even lock the victim out while transferring all linked banking or UPI credentials remotely. Since the RAT runs invisibly, victims may not notice abnormal activities until large transactions or data theft has occurred.
Victims can suffer heavy financial losses, identity theft, and privacy invasion. Because these scams bypass normal Play Store checks and use phone accessibility permissions, even tech-savvy users can be caught unaware. This scam exploits India's deep penetration of mobile payments and Aadhaar-linked services, making awareness crucial to staying safe.
Visual Intelligence: Visual Pattern Recognition
BharatSecure's AI has identified this as a visual pattern recognition used in scams targeting Indian users.
Who Does APK-Based Remote Access Trojan (RAT) Scam Target?
Android users, utility bill payers
Red Flags — How to Identify APK-Based Remote Access Trojan (RAT) Scam
- Request to install apps via .APK link instead of Play Store
- Request for 'Accessibility Service' permissions
- Screen goes black during 'update' process
What To Do If You Encounter APK-Based Remote Access Trojan (RAT) Scam
- Immediately uninstall any app installed from links outside the Google Play Store.
- Disable Accessibility Services for any unknown or suspicious apps via your phone settings.
- Change all your banking, UPI, and Aadhaar-related passwords and PINs immediately.
- Scan your phone with a trusted antivirus or anti-malware app from the Play Store.
- Report the incident to your bank and file a complaint with the cybercrime cell at your local police station.
How to Report APK-Based Remote Access Trojan (RAT) Scam in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What is APK-Based Remote Access Trojan (RAT) Scam?
- APK-Based Remote Access Trojan (RAT) Scam is a reported kyc scam that BharatSecure has documented as affecting Indian users. Fraudsters use it to trick victims into sharing money, OTPs, or personal and banking details. It currently carries a risk rating of 10/10 (Critical).
- Is APK-Based Remote Access Trojan (RAT) Scam dangerous, and how common is it in India?
- Yes. This scam is rated Critical severity (10/10) because it can lead to direct financial loss or identity theft. It spreads through SMS, WhatsApp, phone calls, and fake websites, and variants are reported across India throughout the year. Treat any unexpected message or call matching this pattern as suspicious until verified.
- How can I protect myself from APK-Based Remote Access Trojan (RAT) Scam?
- Immediately uninstall any app installed from links outside the Google Play Store. Disable Accessibility Services for any unknown or suspicious apps via your phone settings. Change all your banking, UPI, and Aadhaar-related passwords and PINs immediately. Scan your phone with a trusted antivirus or anti-malware app from the Play Store. Never share OTPs, UPI PINs, card numbers, or passwords; verify any request independently using official numbers from the company's real website; and avoid clicking links in unsolicited messages.
- How do I report APK-Based Remote Access Trojan (RAT) Scam in India?
- Call 1930 (the National Cyber Crime Helpline) within 24 hours for the best chance of recovering funds, and file a complaint at cybercrime.gov.in with screenshots and transaction details. Notify your bank's fraud team to freeze transactions, and report the suspect UPI ID or phone number to BharatSecure so other users can be warned.
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.