Exclusive | APK fraud surges 190% in Karnataka, senior citizens among worst hit

While headlines about cybercrimes in Karnataka have largely focused on digital arrests and investment fraud, the state is witnessing a silent, worrying trend: the rapid rise of Android Package Kit (APK) fraud.

Exclusive data accessed by DH showed APK fraud in the state skyrocketed by a whopping 190.46% from 325 cases in 2024 to 944 cases in 2025.

This year, the state has already reported 458 cases till April. At this rate of 114.5 cases per month, the state is projected to register 1,374 cases of APK fraud this year.

Unlike digital arrest scams and investment frauds, aka pig butchering scams, APK fraud doesn’t rely on psychologically manipulating victims with threats, harassment or greed.

Cybercriminals will send a message on WhatsApp or Telegram, creating a false sense of urgency: a pending electricity bill leading to a connection termination, pending credit card points, a KYC update, an invitation for a wedding, etc. These messages will be accompanied by an .apk file.

While the .apk extension is the standard file format used to install legitimate Android applications, third-party APK files sent by the fraudsters can allow back-door access to the devices. These malware-laced files can be custom-built or easily bought on Telegram marketplaces and the dark web, investigators say.

Once installed, they mostly remain hidden.

“Cybercriminals purchase these customizable APK kits and use them as per their need. One day, the message may be about banking, the next day it may be about a friend’s wedding. They will also use any major news events to alter the messages. If a known contact’s phone is compromised, it will automatically forward the malicious APK file to all their contacts and WhatsApp groups. Victims click, thinking the message is from a known person,” a senior cybercrime investigator in Bengaluru told DH. 

Once they have access, fraudsters intercept OTPs to transfer funds from bank accounts. But the threat also goes beyond a financial loss. “When an APK file containing malware like a Remote Access Trojan (RAT) infects a mobile phone, they have complete access to the data and files, including call logs, messages, documents, photographs, videos, etc. With spyware-laced APKs, they can even remotely access the camera and microphones,” another senior officer in Bengaluru claimed. 

Sr citizens most affected

Case trends analysed by DH showed that most of the victims tend to be senior citizens and those with minimal tech knowledge, though devices have also been compromised by children accidentally clicking on the files on their parents’ phones. 

While police will attempt to trace the lost funds, prevention is key. “Modern Android operating systems have a failsafe: ‘Install from Unknown Sources’. Public should ensure they don’t click on this option even after accidentally clicking on an APK file, as it will allow the malware to be installed,” the senior officer quoted above said.