A wedding invitation, bank statement or regulatory notice on WhatsApp can hide malicious software. It can steal sensitive data and compromise financial accounts. India’s cybersecurity agencies warn that criminals disguise malware as familiar documents so people open dangerous attachments.
Two campaigns are at work. The APK scam targets Android users with fake app installers. A related campaign uses zipped account statements and fake Reserve Bank of India (RBI) messages to infect Windows computers. Both exploit trust in familiar senders and routine-looking messages.
How the APK Scam Works
An Android Package Kit (APK) is a file that installs apps on Android phones. Unlike an image or document, it can add software that asks for access to sensitive phone functions.
Fraudsters send these installers over WhatsApp, sometimes from the hacked accounts of friends or relatives. The file may carry a harmless name, such as Wedding Invitation.apk.
India’s Computer Emergency Response Team (CERT-In) documented a SpyMax Android malware campaign on June 25, 2025. It used fake wedding invitations sent through WhatsApp. The app asked for accessibility, notification and SMS permissions. It could then collect messages, contacts, keystrokes and banking OTPs and send them to an attacker’s server. Some versions hid their app icons.
Wedding invitations work as bait because people expect them from relatives and colleagues. The sender’s account may already be compromised. An invitation should never need you to install software or share SMS access. Union Bank of India’s awareness material also warns against wedding invitation APKs sent over WhatsApp.
Fake RBI Files Target Finance Teams
The Indian Cyber Crime Coordination Centre (I4C) has identified a separate campaign. It targets chartered accountants, company directors, chief financial officers and corporate finance teams.
On August 7, 2026, the Ministry of Home Affairs warned about files named Statement of Account.zip, RBI.zip and MCA.zip. The archives hold malicious Windows executable files. The messages imitate account statements or urgent notices from financial regulators.
I4C said attackers used the hijacked WhatsApp accounts of senior executives. They sent fake payment instructions to finance staff, aiming to move company money into mule accounts.
The agency alerted more than 58,000 potential victims by SMS over the previous 30 days. It also said action against attacker-controlled infrastructure had helped protect more than 10,000 Indians. These figures cover this campaign only, not all WhatsApp malware.
How Devices Get Compromised
These attacks usually need the victim to install an app, run a program or grant permissions. Receiving a file alone does not normally compromise a properly updated device.
On Android, malicious apps can abuse accessibility, notification and SMS access to capture data. On Windows, executables or scripts can set up remote access or hijack active WhatsApp sessions.
CERT-In also warned in June 2026 about malicious VBScript attachments posing as invoices, payment records and account statements. Running one could allow credential theft, remote access and more malware.
Spotting a Dangerous File
Be wary of any unexpected file that asks you to install something. This applies most when it claims to be a wedding card, bank notice or regulatory document.
Android users should avoid APK files from messaging apps. Windows users should check compressed archives for .exe, .dll, .vbs or other executable files.
Call the sender yourself. Check the real file extension. Do not enable unfamiliar permissions. A message from a saved contact does not prove a file is safe. The RBI has also warned about impersonators who pressure customers into installing unauthorised apps, using threats of account suspension or regulatory action.
If You Installed It
Disconnect the device from mobile data and Wi-Fi at once. Do not use it for banking or enter more passwords. From another trusted device, contact your bank, secure your accounts and change any passwords that may be exposed. Check WhatsApp’s linked devices and remove any you do not know.
On Android, remove suspicious apps and run a trusted security scan. On Windows, get qualified technical help, especially for corporate accounts or financial records. A badly compromised device may need a clean reinstall.
If money has left your account without permission, tell your bank immediately. Report it on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call 1930. Keep suspicious messages, transaction references and complaint acknowledgements for investigators.
Quick Answers
- Can a wedding invitation APK steal banking data? Yes. CERT-In has documented such apps reaching SMS messages, notifications and sensitive device data.
- Can I be infected just by receiving one? Normally no. These attacks need installation, execution or another unsafe action.
- Are PDF invitations safe? A PDF is not an Android installer, but unfamiliar PDFs and links can still be risky. Verify them first.
- Are RBI.zip and Statement of Account.zip Android APK scams? No. That campaign used malicious Windows executables inside zipped archives.
- Can a friend’s account spread malware? Yes. A hacked account can send malicious files to its contacts, which makes them look trustworthy.
- Where do I report a loss? Tell your bank, call 1930 and file a complaint at cybercrime.gov.in.
