How the Free Content App Scam Works
These applications can be distributed through social media ads, sponsored search engine results, messages with links to fraudulent pages that mimic streaming platforms, etc.
The process usually begins with an attractive offer. Clicking on it redirects the user to a page that directly downloads a malicious file. By default, phones block the installation of apps from sources other than official app stores. Therefore, cybercriminals try to trick users into accessing their phone’s settings and enabling the “Install unknown apps” option or disabling Google Play Protect (in the case of Android).
| Warning sign | Why it is suspicious |
| Download from an unknown source | The app may not have been checked by an official app store. |
| Request to disable security features | It may be trying to bypass Android’s built-in protections. |
| Unnecessary accessibility permissions | The app may be seeking broader control over the device. |
| Requests for unrelated permissions | Access to messages, notifications, or app installation may be unnecessary for video playback. |
| Unexpected phone behavior | Unknown apps, repeated permission requests, or unusual banking screens may indicate malware. |
Main Warning Signs of Malicious Apps
- Downloads From Unknown Sources: The download is from an unknown source. Be suspicious by default when access to the application comes from a social media ad or a link received via SMS, instant messaging chats, or email.
- Requests to Modify Device Security: It requests you to modify the device’s security. Do not continue if the instructions ask you to disable protection features, ignore a warning, or allow installations from unknown sources.
- Requests for Accessibility Services: The app requests access to accessibility services. This permission is not usually required to play content. Such a request must be clearly justified by a legitimate accessibility function; for example, to make the app easier to use for people with disabilities through specific assistive features.
- Unnecessary App Permissions: It requires unnecessary permissions for its function. Reading messages, accessing notifications, managing the device, or installing other applications are not typical functions of a video player.
- Unusual Phone Behavior: Your phone starts behaving strangely. Apps you don’t remember installing appearing, icons disappearing, repeated permission requests, or unusual screens when accessing online banking can all indicate a problem.
Best Practices for Protecting Your Devices
Always download applications from official app stores or from the developer’s official website (by typing the web address into your browser).
Before downloading, verify that the developer name and app logo are official . You can find this information on the app’s page in the official store and, if in doubt, check the service’s official website. Also, review other data available in the store, such as the number of downloads, ratings, and user reviews.
Always keep your phone’s protection features enabled. Don’t disable systems that scan apps for threats, block potentially dangerous installations, or warn about apps from unknown sources.
Always keep your device’s operating system and applications up to date. New versions fix vulnerabilities and improve protection against known threats.
Use different passwords for each service and enable two-factor authentication whenever available.
Do not store passwords, bank details, or recovery phrases in your device’s unprotected notes. If an app gains access to your device’s contents, it could expose this information.
Remember this basic rule: an app for watching football, movies, or TV series doesn’t need to control the rest of your phone. If it requests permissions unrelated to its function or asks you to lower your device’s security, cancel the installation.
What to Do if You Have Installed a Malicious Application
Disconnect Your Phone From the Internet
Activate Aeroplane Mode and manually disable both Wi-Fi and mobile data. This can disrupt the malware’s active communication with external servers and reduce the risk of it continuing to send information or receive instructions. If the malware is already active, some data may have been compromised before you detect the problem.
Uninstall the Malicious Application and Remove Its Permissions
Uninstall the app and remove its permissions. Go to your device’s settings and look for the suspicious app. If you don’t see it in the list, look for generic names, transparent icons, or recently installed apps you don’t remember. Select the app, tap “Force stop”, clear its data/cache, and then select “Uninstall”.
Avoid Logging Into Banking Apps or Entering Passwords
Do not log into any banking apps or enter passwords on the device until the disinfection process is complete.
Run a Security Scan
Run a security scan. Turn off aeroplane mode, connect to the internet, and run a full scan using a reputable antivirus tool to ensure no malicious code remains.
Protect Your Accounts From Another Secure Device
Protect your accounts from another secure device. From a computer or another mobile device that is not infected, change the passwords for your main accounts (email, social media, bank), check your bank accounts for unauthorised transactions, and enable two-step authentication on all services where possible.
Contact Your Bank if Your Financial Details May Be Compromised
If you believe someone has compromised your bank details, contact your bank as soon as possible. Always contact them through their official channels and explain what happened so they can advise you on the appropriate security measures. Review your account and card transactions, and if you notice any unfamiliar activity, report it to your bank immediately. It’s also advisable to be especially wary of any fraudulent calls, messages, or emails that use the compromised information to try to obtain more data or credentials.
Consider a Factory Reset if Problems Continue
If after performing these steps the phone continues to exhibit strange behaviour (constant pop-ups, excessive overheating, or atypical data consumption), the most definitive measure is to perform a factory reset of the device (after backing up only your files, not the applications).
Also Read: OTP Code Via SMS For Safer Access And Protected Systems
