What was once used for birthdays, weddings, corporate events, and social gatherings has increasingly been weaponized by cybercriminals as a sophisticated phishing technique.
The security research community has observed that threat actors are increasingly using commonly used invitation platforms and compromised email accounts to distribute fraudulent event links designed to harvest credential information, financial data, and sensitive personal information by leveraging their credibility.
It is evident how even routine online interactions are becoming part of the modern cyber threat landscape when malicious emails mimic legitimate invitation services and utilize the psychological urgency of social engagement. This highlights how even routine online interactions are now a source of cyber threats.
A cybersecurity investigator has noted that the threat is now extending far beyond deceptive email invitations, as hackers are actively distributing malware-laced Android Package Kit (APK) files disguised as digital event invitations via messaging platforms such as WhatsApp and Telegram.
A malicious file is often accompanied by socially engineered labels, such as wedding invitations, housewarming ceremonies, or private party invitations, which are designed to reduce suspicion and stimulate immediate downloads. It often mimics utility tools, but remains operationally dormant to avoid detection once installed on an Android device.
Once embedded, the rogue application quietly embeds itself among legitimate applications, frequently imitating utility tools.
It has been reported that victims unknowingly grant extensive permissions to threat actors, including access to call logs, SMS services, notifications, contacts, and screen recording capabilities, effectively giving them deep surveillance access to their devices.
Several observed cases have demonstrated that the malware can intercept one-time passwords, monitor banking and UPI sessions in real-time, and harvest financial credentials directly from user screen activity.
Recently, a Bengaluru-based business owner has experienced the severity of the attack chain after receiving a fraudulent wedding invitation APK through WhatsApp, causing unauthorized access to financial information and a financial loss of approximately 5 lakh before detection of the compromise.
A number of researchers investigating these campaigns have concluded that the attack infrastructure is typically conducted using two highly effective compromise methods that bypass user suspicion and device-level trust mechanisms. As a result of interaction with the malicious invitation link, the link appears broken or inactive. However, behind-the-scenes processes silently deploy credential-stealing malware that harvests passwords, device information, and sensitive personal information.
Secondly, victims are directed to convincingly spoofed login portals in which their account credentials are captured in real time, allowing threat actors access to banking, email, and payment services without their consent.
A number of fraudulent invitations deliberately avoid detailed event information in order to induce impulsive clicks, depending instead on urgency and familiarity.
In addition to users being advised to treat unsolicited invitations with caution, particularly those received through messaging applications or from unknown senders, IT security experts also recommend reporting and deleting suspicious e-mails as soon as they become aware of them.
According to threat intelligence firm CloudSEK, these campaigns have resulted in large-scale financial fraud operations. Within 48 hours, one threat group processed transactions worth nearly 25-30,000 crores, emphasizing the rapid scalability of the ecosystem and the high number of victims involved.
Specifically, the firm found that the attacks exploit the trust architecture behind SIM-based verification systems commonly used by UPI platforms.
In such systems, device-linked mobile numbers are considered proof of legitimate account ownership.
A malicious APK disguised as a traffic violation notice or a digital invitation is often the first step in establishing covert access to a smartphone's messaging features after securing SMS permissions.
After deploying the so-called “Digital Lutera” toolkit, CloudSEK indicated that attackers manipulate identity validations and SMS workflows through a specialized Android framework on separate devices.
With this feature, bank registration messages may be intercepted and OTPs are silently forwarded to attacker-controlled Telegram channels without the victim's knowledge.
Additionally, the report revealed that fabricated "sent" SMS records are inserted into message histories in order to maintain an illusion of legitimate activity, such that UPI applications are misled into believing that authentication requests originate from the victim's own smartphone.
Thus, cybercriminals have the opportunity to remotely register and manage the UPI account of a victim even when the original SIM card remains physically in the user's possession. Previously, CloudSEK notified regulators and financial institutions in order to strengthen mitigation frameworks before the threat expands. As part of its responsible disclosure process, it said that it has already notified regulators and financial institutions.
The convergence of digital payment ecosystems and mobile-first communication platforms represents a shift toward socially engineered, device-centric financial attacks, warn cybersecurity experts.
Threat actors are increasingly exploiting human behavior and weaknesses in authentication workflows to exploit APK sideloading, SMS intercept frameworks, and compromised messaging channels as a means of exploiting trust-driven human behaviour.
A stronger understanding of user awareness, stricter application permission controls, and enhanced anomaly detection across UPI and telecommunication infrastructure will assist in limiting the operational scale of these fraud networks before they become a more persistent threat to India's rapidly expanding digital sector.
.jpg "Trojanized DAEMON Tools Used to Deploy Persistent Backdoor Malware")
.jpg)
