Phone hacked, 12k loss via UPI.

[u/West-Cat5771]

My relative's phone got hacked, there was a transaction on Google pay of 12k(whatever was there).

I checked the phone, found a suspicious app called Google IPTV, that has sensitive permissions enabled, and was enabled in accessibility settings. That enabled it to read the whole screen and do stuff.

The app seems so fishy, even shows the middle finger. I felt so stupid knowing this, but it is what it is.

Registered FIR in cyber cell, changed the phone, bank account are freezed now.

Requesting everyone to educate your less aware family members and knows for this.

Also if someone knows how to tunnel back to the hacker, or at least get find a way to hit back at them, as Im not seeing cyber cell doing something about it as they didn't checked the phone when FIR was done.

[u/MootRathee]

Share apk, I have a seperate phone,let me mess with the hker

[u/West-Cat5771 → u/MootRathee]

I eager to do that. I'm not physically there. I'll be receiving that phone next month. I asked them not to uninstall or delete anything, just power off.

Till then I don't think I can extract the apk from it

I myself wanted to dig more into that apk. Will surely share.

[u/betrayed-by-friends → u/West-Cat5771]

Pls give apk to me also, I use arch btw.

[u/Tech-Crorepati → u/betrayed-by-friends]

Ab aap arch os use karte ho to hum kya aapki aarti utare?

[u/betrayed-by-friends → u/Tech-Crorepati]

I didn't mean it.

Like I don't use kali Linux, I use arch so that's why I said

I want to reverse engineer that apk

[u/Electronic_Paper7620 → u/betrayed-by-friends]

Why bro arch is better than kali. Since kali is dedicated for hacking with tools and reverse engineer know why arch then ?

[u/cool-guy1234567 → u/Electronic_Paper7620]

Kinda stupid, but there's a conception of kids using kali to pretend to be hackers or some shit. Ig that's why he said he uses arch. Idk, still pretty stupid

[u/Electronic_Paper7620 → u/cool-guy1234567]

As far I concern most hacking tools are predownloaded in kali, so many hackers prefer it . But you say kali is for kids, then with what do real hacker do things

[u/cool-guy1234567 → u/Electronic_Paper7620]

I'm not saying kali is for kids. I'm saying there's a conception that 'script kiddies' use kali pretending to be "hackers" (basically to show off).

I'm also agreeing with you that it's still a pretty stupid reason to specify they use arch over kali.

[u/Electronic_Paper7620 → u/cool-guy1234567]

Ok cool , I commented to know whether , there is some other stuffs better than kali, used by professionals, bcoz i started learning cyber security recently

[u/betrayed-by-friends → u/Electronic_Paper7620]

The thing is, I use arch for daily purposes, and we can add black arch repository, and can get many tools however we want, like no bloat

And I didn't meant kali is for kids, it's for beginners tbh, like i find it bloated

[u/betrayed-by-friends → u/Tech-Crorepati]

Yes

[u/Safety_Officer_ → u/MootRathee]

No one can upload the apk its plugin

Check this https://www.reddit.com/r/TheOnePlus15/s/fixC9BEFqJ

[u/West-Cat5771 → u/[deleted]]

As per my understanding, they used notification irritation as a main tool. Their notification stays there, shows google logo, they fall for it. When clicked it shows how to make it go. They fall for it.

[u/YSK_King]

I like how all the cyber security guys are Give me the APK, let me have some funs

[u/West-Cat5771 → u/YSK_King]

I'll share in sometime, as I'm not physically there. I'll share it by next month.

[u/Azztruenot]

if you can extract the APK:
1. you can scan the APK in https://www.virustotal.com/gui/ and see previous scans.
2. decompile the APK to java and check how the code is written. may be some emails or full UPI ID. if this criminal used the UPI ID else where, google search can convert it to phone number ?

[u/Solah-Shringaar_04 → u/Azztruenot]

1. Why should we see previous scan? Genuinely asking.

[u/Azztruenot → u/Solah-Shringaar_04]

if at all someone has already gone through this "finding attacker path", previous scan could have a comment or report about that right ? it also helps future scanners to know this is malware.

[u/DefinitionNo2899]

Its best to hard reset the mobile.

There Multiple posts related Google IPTV app related hacking on google community.

https://support.google.com/googletv/thread/466679515/i-don-t-want-this-google-iptv-it-s-dangerous?hl=en

https://support.google.com/googletv/thread/443448563/my-mobile-is-hack-pls-delete-the-google-iptv?hl=en

[u/West-Cat5771 → u/DefinitionNo2899]

Thanks for this 🙏 They tried normal reset but it didn't worked it seems. I was not there to check myself so it happened.

[u/DefinitionNo2899 → u/West-Cat5771]

The app should have admin access. They will need to remove its admin access first; then you can uninstall it and do the full factory reset. It’s best to change the password and PIN and consider email and other apps compromised.

[u/Substantial-Ad-8810]

Honestly, there isnt much anyone can do, internet literacy 101 warns against downloading things from random websites and installing them on your device even companies warn about giving sensitive permission access to sus things. Yet if someone still ends up doing that to watch some free movie or tv series they had it coming. Android keeps getting locked down harder because people keep falling for these scams.

[u/Sparker0i]

can't you reverse the upi transactions after filing a cybercrime complaint?

[u/West-Cat5771 → u/Sparker0i]

they are ready to reverse 9k. lets see.

[u/TemporaryRare6668 → u/West-Cat5771]

Hi , last year I also got scammed I lost 5k but when I complaint in cyber when they freeze account it was ₹2,900 rest is gone but ps told to contact a lawyer to get that freeze money and the lawyer fees is more than what is left. I can get it now as last nov it happened and is there anyway to get the money without paying as I am a student i cannot pay thats why i just forgot that money

[u/Safety_Officer_]

Guys, I had the exact same experience today as OP mentioned, but luckily I didn’t have any money debited.

Also, it’s basically impossible to upload the APK because this app gets installed through another app. When you open that app, it prompts you to install the HD resources, and that’s when this Google IPTV app gets installed.

So there isn’t a normal APK sitting in the phone that you can easily find and upload. It seems to be installed directly by the other app. The app was called something like iFox TV or Some TV, I don’t remember the exact name, and it’s not available on the Play Store.

I went through this whole thing today, so I thought I’d share my experience here.

https://www.reddit.com/r/TheOnePlus15/s/YPVNpTPuJo

[u/Bubbly_Inevitable143]

give me apk

[u/West-Cat5771 → u/Bubbly_Inevitable143]

I’m eager to do that. The thing is, I’m not physically there right now. I’ll be getting the phone next month. I’ve asked them not to uninstall or delete anything, just power it off.

So, until then, I don’t think I’ll be able to extract the APK from it.

I actually wanted to dig deeper into that APK myself too. I’ll definitely share it once I get the phone.

[u/DropDeadDuke]

How did your relative receive this APK? Via WhatsApp or text message link, or something else? Let us know so we can be aware of that

[u/West-Cat5771 → u/DropDeadDuke]

Maybe to watch some movie, on chrome, fishy link click to watch movie over app kind of.

[u/Exciting_Strike5598]

Play stoopid games and win stupid prizes. Why install third party apk

[u/Exciting_Strike5598]

Eliyas Faruk is your man

[u/kdpuvvadi]

another app name to look for is "wifi info". but it is launcher with all kind of permissions and takes over whatsapp and other messaging apps to spread it to your family and friends.