Telangana Cyber Security Bureau Issues Public Advisory on Rapidly Spreading WhatsApp Takeover Scam; Check How to Stay Safe
TGCSB Director Shikha Goel, urges citizens to remain vigilant and avoid installing any apps or following suspicious instructions received via WhatsApp or SMS.
Hyderabad, November 6: The Telangana Cyber Security Bureau (TGCSB) has issued an urgent public advisory warning citizens against a rapidly spreading WhatsApp Takeover Scam, where fraudsters are circulating malicious APK files disguised as legitimate apps such as RTA challans, bank KYC updates, courier invoices, or customer care applications.
Once installed, these fake apps gain control of users’ SMS and contacts, enabling attackers to re-register the victim’s WhatsApp on their device and impersonate them to defraud contacts.
Even iPhone users are being targeted through call or SMS forwarding tricks — victims are deceived into dialing codes like **21*number#, unknowingly diverting calls and OTPs to fraudsters.
How the Attack Works
- Fraudsters send links or APKs on WhatsApp.
- On installation, the app requests permissions to read SMS and OTPs.
- The attacker uses these OTPs to take over the user’s WhatsApp account.
- The victim is logged out while the attacker messages contacts pretending to be them and soliciting money.
Immediate Safety Steps
- Disable call forwarding.
- Uninstall unknown apps and perform a factory reset if infected.
- Reinstall apps only from Play Store or App Store.
- Reinstall WhatsApp and verify using your number.
- Use the M-Kavach 2 app (Government of India mobile security tool) to detect malicious apps.
- Enable two-step verification in WhatsApp.
Reporting & Support
Victims should:
- Dial the Cyber Fraud Helpline 1930 for financial loss.
- Report incidents at www.cybercrime.gov.in.
- Use the Cyber Fraud Registry (8712672222) for assistance.
Director Shikha Goel, IPS, urged citizens to remain vigilant and avoid installing any apps or following suspicious instructions received via WhatsApp or SMS.
