This ‘Wedding Invitation’ Message on WhatsApp isn’t what it seems – Here’s the shocking truth

Cybercriminals are circulating fake wedding invitation APKs on WhatsApp that can steal your bank details and personal data. Here’s how the scam works and how to protect yourself.

“Save the date… You’re invited… Please join us for the celebrations” – A cheerful invitation to the most joyous day in a person’s life can be a backdoor into your financial and private life, security experts have warned.

Cyber-criminals are sharing malicious Android Application Package (APK) files on messaging apps like WhatsApp – masquerading as digital wedding invites – that, once installed, can pose serious financial and privacy-threats.

In multiple reports, users have said that they receive WhatsApp messages from unknown (sometimes familiar-looking) senders that say things like, “You are invited to our wedding” or “Save the date”. Attached is a link to an APK file.

Downloading the APK file from the message link, under the guise of a digital wedding invitation, causes malware to be installed on the phone. The malware, in turn, gives the attacker remote control of the phone.

With remote control, the attacker can access and steal SMS messages, contacts, banking apps, OTPs, and other sensitive information from the device. In some cases, the attacker hijacks the phone and sends further messages to the victim’s contacts, asking them for money or for further transactions, for example.

In one case reported earlier this year, a government employee in Maharashtra received a WhatsApp message containing what appeared to be a link to a wedding invite. The employee clicked on the link, which installed malware on the phone, which was then used to drain the account of all funds.

In the state of Kerala, four members of a family lost money in similar circumstances. HDFC Bank has also warned its customers of this threat, and advised them not to download apps from unofficial sources or links.

How the attack works-

1. You receive a message (on WhatsApp, SMS, etc.) with a digital invite to a wedding.

2. The message contains a link to download an APK file (or a disguised malicious link).

3. Believing the message, you click on the link and install the file, sometimes even ignoring Android’s warning “Install apps from unknown sources”.

4. The malware is now installed on your device, which can silently execute the following:

5. Harvest credentials and data;

6. Read SMS;

7. Inject overlays to steal banking credentials;

8. Perform other actions (depending on the malware’s code).

Using these, the attacker may:

– Make unauthorized transactions, empty your bank account;

– Send fraudulent SMS or WhatsApp messages to your contacts;

– Spy on your private life (photos, messages, and other private data).

Protect yourself from fraud

Never download and install .apk files from unknown senders, especially when a simple image or PDF file would be enough for a digital invitation.

Check the file extension: a wedding invitation should usually be .pdf, .jpg, or .png, not .apk.

Check the sender: if an invitation comes from an unknown number, or an unusually polite and courteous tone, then it’s worth double-checking.

Keep your Android OS and security software up-to-date.

Do not give apps excessive permissions on your device: check permissions after installation.

If you think you have been a victim of fraud, immediately contact your bank and report the incident to the cyber-crime police.

In the digital age of instant messaging and virtual invites, the faith we place in a simple, friendly “You’re invited” can be exploited by cyber-criminals. Even when celebrating casually online, be careful of hackers. They can use a party or event as a way to attack you. Never click on links you don’t know, always check the files you download, and make sure the sender’s email address is real. A little caution can stop you from losing money, your information, and trust. Stay safe!