Facebook removed dozens of digital ads on August 31, 2026, after the Indian government pointed out a scheme present on the social network’s platforms and Instagram. The content used explicitly sexual material to lure users into downloading sophisticated malware designed to steal banking credentials and empty accounts.
India has faced a notable rise in cyber attacks, with losses estimated at nearly $2.4 billion by 2025, as per official data. Scammers have focused their attention on the country’s expanding digital payments sector, taking advantage of rapid digitalization to carry out financial fraud.
The Indian government revealed that the advertisements, released under the names “Night Play” and “Kyss”, directed users to phishing pages. This type of digital scam induces victims to provide passwords and personal data, pretending to be financial institutions or trusted stores.
Authorities have observed a sharp increase in financial fraud involving “malicious Android applications disguised as pornographic applications”, indicating a common tactic among criminals to deceive users.
An investigation by the news agency found that, even after the government’s warning, at least 39 of these ads were still active on Meta’s platforms. Many of them displayed thumbnails of videos with explicit sexual content to maximize clicks.
Meta moved to remove all remaining ads shortly after being notified by the agency about the issue. The company, however, chose not to comment on the alert and the actions taken.
The North American technology giant’s guidelines are clear in prohibiting advertisements that contain “adult nudity or sexual activity.” The policies also prohibit advertisements for “products, services, schemes or offers that use practices identified as deceptive or misleading”, which includes attempts to steal money from users.
This is not the first time India has expressed concern about financial fraud on major technology platforms. Previously, the government ordered Google to disable hundreds of accounts on its Firebase service, which were being used by criminals to impersonate large banks in similar scams.
Internally, Meta had predicted that fraudulent and banned product advertisements could generate about 10% of its revenue in 2024, approximately US$16 billion, despite the company’s claims that it is actively combating these types of advertisements.
One of the ads that remained active led to a website promoting a video app, promising access to hundreds of pornographic videos and content 24 hours a day.
To gain access, users were instructed to download a file called “Movexa.apk” directly, outside of official app stores such as the Google Play Store.
The Indian alert emphasized that these apps can covertly access information stored on users’ phones, capture one-time passwords (OTPs) and banking PINs, facilitating the transfer of money from accounts without the holders’ consent.
