Mobile cyber attacks are putting Hyderabad users at risk of personal data theft and financial fraud, with police warning that malicious applications, phishing links and even some attacks requiring no user action can compromise phones.
The warning follows recent investigations by the Hyderabad Zonal Enforcement Directorate (ED) into methods used by cybercriminals to access mobile devices and obtain sensitive information. Hyderabad cyber crime DSP Srinivas said several financial fraud cases involving newly downloaded mobile applications had been reported recently, with about three such cases being recorded every month on average.
Srinivas cautioned users against downloading applications without checking their authenticity or submitting information on forms without reading the details provided. Police have identified malware, spyware and phishing as three major forms of attack targeting mobile phones.
Malware refers to malicious software that can be used to steal personal information or display fake advertisements. Police said the risk increases when users download and install Android Package Kit (APK) files from unknown websites. Spyware can secretly monitor activity on a device and obtain personal information, location details, messages and other stored data.
Phishing attacks typically begin with fraudulent messages designed to pressure recipients into clicking a link. The messages may falsely claim that a bank account has been blocked, a parcel is being held, a gift has been received or an account needs immediate verification. Users are then directed to fake websites and may be asked to provide one-time passwords (OTPs), passwords and other sensitive information.
Recent raids by ED officials also found that an international gang had allegedly used similar methods to target Americans and defraud them of crores of rupees, according to the report. Vaishnavi Tejaswini, an employee of a multinational company, advised mobile users not to share OTPs, particularly with unknown people seeking personal information.
The risk is not limited to attacks that require a user to click or download something. K. Viraj Shekhar, deputy analytical officer with the Karimnagar police commissionerate, said most cyberattacks required victims to take an action, such as clicking a link, downloading a file or installing an application. He also warned of zero-click attacks, which can occur without any action by the victim and may be difficult to detect.
The dependence on mobile devices has expanded as banking, electricity-bill payments and other financial transactions move online. Shekhar said regularly updating mobile operating systems and applications could help reduce the risk of cyberattacks. Police advice also places emphasis on checking application sources, scrutinising requests for personal information and treating unsolicited account, parcel or payment messages with caution.
