On this page
The night before a unit test, someone in your class group forwards "Organic_Chemistry_Notes.apk" with "free notes, install fast". Notes are documents. A file ending in .apk is an app, and installing it puts a stranger's code on your phone, next to the SMS inbox where your bank one-time passwords (OTPs) arrive.
What is an APK file, and why does it matter in a study group?
An APK (Android package) is the file Android phones use to install an app, according to Android's developer guide. Nobody needs to send you an app to share notes.
Apps installed from outside the Play Store are the main route for this kind of fraud. In its announcement of an India fraud-protection pilot in October 2024, Google said that for major fraud-malware families that misuse sensitive permissions, over 95 percent of installations came from Internet-sideloading sources: web browsers, messaging apps or file managers.
Google's Android Developers Blog reported in August 2025 that it found over 50 times more malware from internet-sideloaded sources than in apps on Google Play.
How can an app from a chat read my OTPs?
It asks for permission, and you tap "Allow". India's cyber-security agency CERT-In described one such campaign on its Cyber Swachhta Kendra alert page in June 2025. A remote-access trojan called SpyMax spread as a fake wedding-invitation APK on WhatsApp and through phishing links posing as Telegram.
Once installed, SpyMax asked for accessibility service, notification access, SMS and permission to install packages. It then sent contacts, SMS content, notifications, keystrokes and bank OTPs to a server run by the attackers.
In a study group, the same trick just needs a new label: "free JEE notes", "leaked sample paper", "paid test series for free".
How do you spot a dangerous file or link?
Check before you tap:
The file name ends in .apk, or the link downloads an app instead of opening a document.
Your phone warns you about installing from an unknown source, and the message tells you to ignore the warning or switch off Play Protect.
The app asks for SMS, notification access or Accessibility. A notes reader needs none of these. Google's India pilot blocks installs of apps from browsers and chats that ask for these permissions.
The message pushes urgency: "only for 1 hour", "delete after installing".
A familiar name is not proof. Ask the friend on a call whether they really sent it.
Parents can find more in our guide to talking to your child about scams and OTPs. Similar signs apply to AI-written phishing emails aimed at students.
What should you do if you already installed one?
Act fast, with a parent if you can:
Turn on airplane mode so the app cannot send anything more.
From another phone if you can, call your bank on the number printed on your card or passbook, say a harmful app may have read your OTPs, and ask them to block cards and UPI if needed. CERT-In's SpyMax alert advises reporting unusual account activity to your bank immediately.
If money has already left an account, call the national cybercrime helpline 1930 and file a complaint at cybercrime.gov.in. The Ministry of Home Affairs says its fraud-reporting system exists for immediate reporting of financial frauds and to stop fraudsters moving the money.
Open Settings, then Accessibility, and switch off anything you do not recognise. Then uninstall the app from Settings, then Apps.
If it will not uninstall or keeps coming back, restart in safe mode and remove recently downloaded apps one by one, as Google's Android help describes. Your phone maker's support site shows how to enter safe mode.
Open the Play Store, tap your profile icon, then Play Protect, and keep it switched on. Google Play Help says it checks your device for potentially harmful apps from other sources.
From another device, change your email and net-banking passwords, and reset your UPI PIN once the app is gone. If the phone still acts oddly, take it to an authorised service centre.
For what to set up before anything goes wrong, see our guide to UPI and online money safety for students.
What can you say in the group, and at home?
A short, calm message works better than a lecture:
To the group: "Please don't forward .apk files here. If you have notes, share the PDF or the website link."
Parent to child: "If you ever install something by mistake, tell me straight away. You will not be in trouble. The sooner the bank knows, the more it can do."
And if what you need is a chapter explained rather than a stranger's file, the Fermi Concept Library has a lesson for every concept in physics, chemistry, biology, mathematics and computing.
The habit to keep: notes open, apps install. If a notes file wants to install, delete it and tell the group why.
