After the Indian government warned that malicious Android apps targeting financial information were spreading through Facebook and Instagram ads, Metadeleted dozens of related ads. The problem is that even after the government issued a warning, Reuters still 39 active ads...the fact that I saw it with my own eyes.
These ads used content suggestive of adult material as bait to lure users to external sites, where they were then prompted to download APK files from sources outside official app stores. Investigations revealed that the installed malicious apps posed a risk of intercepting financial credentials and one-time verification codes or taking control of the device.
This incident is more significant for reasons other than the fact that the malicious ads were removed, The fact that the ad passed the review process and continued to run for some time even after the government issued a warning is even more significant. This is a case that prompts us to re-examine the platform's automated ad review process and the speed of its follow-up responses.
| India's cybercrime response agency issued the warning first
Under the Indian Ministry of Home Affairs India Cybercrime Coordination Center (I4C)On August 26, the threat analysis team issued a warning that financial fraud involving malicious Android apps is on the rise. They explained that fake apps, which have been renamed multiple times, are being distributed through Facebook and Instagram ads.
The attacker lured users into clicking on provocative ads and then had them download installation files from external websites rather than official app stores. It's a method that lowers users' guard by linking familiar social media ads with mobile apps.
| At least 39 cases were still active even after the warning
Reuters reported that Even after the government's warning was made public, we confirmed that at least 39 related ads were still being displayed on Facebook and Instagram. Meta took down all of the ads immediately after Reuters reported on them and requested a statement.
Meta did not provide a separate response to Reuters' inquiry. Therefore, it remains unclear when the company became aware of the government warning, how many ads and accounts it investigated in addition to the 39 cases, or whether there were any ad fee refunds or additional sanctions.
| Malicious apps targeted financial information and device permissions
The website linked in the ad prompted users to install the APK file directly. While APKs downloaded from sources outside official app stores aren't necessarily malicious, security reviews and update management are often lax, making it harder to identify potential risks.
According to a warning from the Indian government, the app requests sensitive permissions such as accessibility, and, They could have intercepted stored information, one-time authentication codes, and bank passwords to attempt financial transactions. There was also a possibility that some could install additional components or reroute the device's network through a path controlled by an attacker.
| A gap has been revealed between advertising policy and its actual implementation
Meta's advertising policies prohibit ads for adult content and deceptive products or services designed to trick users out of their money. Even though this ad was highly likely to violate both of these criteria, it passed the review process and was displayed.
Ad platforms have to review a vast number of ad creatives and landing pages in a short amount of time. Since malicious advertisers constantly change app names, URLs, and parts of their videos, Simply deleting individual ads isn't enough; you need to link accounts, payment methods, domains, and app files to prevent repeat traffic.
| The expansion of digital payments in India has become a target
Reuters reports that the losses from cyber financial fraud in India in 2025 are expected to total approximately $2.4 billionIt reported, citing government data, that the figure reached . This means that fraud targeting the rapidly growing digital payment landscape is also on the rise.
Following the Indian government's recent call for action regarding bank impersonation scams involving Google's Firebase, it has now issued a warning regarding Meta ads as well, increasing pressure on global platforms to take responsibility for combating financial fraud.
| Users should check the installation path and permissions first.
Just because an app appears in an ad doesn't mean the platform guarantees its safety. It's safest to make sure the mobile app is available on an official app store and to stop if an ad or message asks you to install the APK directly.
In particular, if an app requests excessive permissions—such as access to location, text messages, notifications, and screen controls—compared to its intended purpose, it’s best not to install it. If you’ve already installed a suspicious app, you should check the status of your accounts and device through your financial institution and official security support channels.
| We need to focus on the system for preventing recurrence rather than the number of deletions
This incident highlights the limitations of the proactive detection system, as the ads were only taken down after the government issued a warning and the media confirmed the issue. While Meta’s removal of dozens of posts was a necessary step, It's more important to make sure that similar content and accounts don't reappear.
Going forward, we need to monitor the total number of ads removed, sanctions imposed on advertiser accounts, support provided to affected users, the time taken to address government warnings, and the effectiveness of detecting recurring ads. As advertising platforms’ revenue structures grow, there is a need to strengthen transparent statistics and external verification regarding malicious ads.
Tags
#Meta #Facebook #Instagram #Malicious Ads #AndroidMalware #Financial Fraud #Cybersecurity #Privacy Protection #APK #Cybercrime in India #Ad Review #Mobile Security
