Background and Timeline: Hyderabad and Cyberabad police registered four separate cases in mid-January 2026 following a surge in malicious mobile application fraud. The incidents, reported between January 5 and January 20, targeted diverse professionals across the city. The breakthrough in understanding the scale of the wave occurred on Tuesday, January 20, when multiple victims approached the cybercrime police simultaneously.
Modus Operandi: Fraudsters circulated malicious Android Package Kit (APK) files via WhatsApp and SMS, disguised as official traffic fine notifications like “rto_echallan.apk”. Once a victim clicked the link and installed the app, it gained full remote access to their phone, including the ability to read SMS and email inboxes. Scammers then secretly intercepted one-time passwords (OTPs) to carry out unauthorized bank transfers or high-value credit card purchases without the victim’s knowledge.
Victims and Financial Impact: At least four victims were duped of a combined ₹11.2 lakh within minutes of installing the malicious files. A 35-year-old goldsmith from Ghansi Bazar lost ₹3.71 lakh, while a software engineer from Yousufguda suffered unauthorized ICICI credit card purchases worth ₹5.2 lakh. Other victims included a data analyst from Manikonda and a private employee from Moosapet, highlighting that tech-savvy professionals are not immune to these traps.
Investigation and Agencies Involved: The Hyderabad City and Cyberabad Cyber Crime police are conducting a joint investigation into the origin of the malicious domains. Technical teams are utilizing the 1930 national helpline to coordinate with banks for real-time freezing of the siphoned funds. Authorities have achieved a 95% recovery rate in cases where victims reported the fraud within the “Golden Hour”.
Arrests and Suspects: Cases have been registered under Sections 318(4) and 319(2) of the Bharatiya Nyaya Sanhita (BNS) and relevant sections of the IT Act. No specific arrests were announced for this wave, but investigators are profiling regional syndicates that specialize in APK distribution. Police warned that these scams often use URL shorteners or “.xyz” domains to mask the download source.
Broader Implications and Trends: This wave signals a transition toward technical exploits that target mobile device permissions rather than traditional social engineering. Authorities have issued an urgent advisory clarifying that government agencies, including the Transport Department, never circulate APK files for fine collection. Citizens are urged to use only official app stores and to dial 1930 immediately if they suspect their phone has been compromised.