Telangana hit by massive APK-based cyberattack, hundreds of WhatsApp groups compromised

A large-scale cyberattack using malicious Android Package Kit (APK) files has compromised hundreds of WhatsApp groups across Telangana, with cybercriminals gaining control of mobile phones belonging to citizens, journalists, officials, and even public representatives.

The attack began on Sunday (November 23) after thousands of users received WhatsApp messages from a fake sender named Team State Bank of India (SBI). The message falsely warned that their bank accounts would be blocked for not updating Aadhaar and KYC details, urging them to click a link to “upload” information.

Fearing account deactivation, many SBI customers clicked the link and unknowingly downloaded an infected APK file. Once installed, the malware gave hackers remote access to their phones, enabling them to forward the same scam message to multiple WhatsApp groups. Even WhatsApp channels created by Telangana ministers for communication with beat journalists were compromised.

Panic spread as victims realised that their personal data, chats, and phone activity had been exposed. Several affected individuals have filed complaints with local police.

Cybercrime officials have urged citizens not to open suspicious APK files and to follow immediate safety steps if infected:

• Turn off mobile data and uninstall the malicious app from Settings.

• Run a full scan using a trusted antivirus app.

• Change passwords for banking, email, and social media accounts.

• Check call logs, messages, and bank transactions for unusual activity.

• If the app cannot be removed, restart the phone in safe mode and try again.

• If problems persist, back up data and perform a factory reset.

• In case of financial loss, freeze your bank account and call the cybercrime helpline 1930.

The Telangana Cyber Security Bureau has advised citizens to remain vigilant, avoid clicking unknown links, and never install apps sent through WhatsApp.