Free match, rigged app: how to spot the malware that steals your mobile money PIN

The link lands in a WhatsApp group, sometimes forwarded by someone you know. It promises tonight’s match live with no subscription, or a recent film for free. All you have to do is download a small app. On Tuesday and Wednesday the Champions League played its second round of games, exactly the kind of evening when that message does the rounds.

On October 9, Senegal’s national police headquarters denounced a “vast fraud campaign” aimed at users of mobile financial services, in a statement signed by Superintendent Mamadou Diouf, head of its communications and public relations division. According to the police, the malicious apps and deceptive links are used to “quietly steal secret codes”. The fraudsters then take over the account and move the money out from the victim’s own phone. Investigations are under way; the statement gave no number of victims and no amounts.

On October 6, NovoTech described the scams that target Wave accounts through trickery over the phone. The scheme flagged this week works differently: the victim hands nothing to anyone. Their own phone does the work for the crook.

What the app does once it is installed

It all starts with an .apk file, the format of Android apps. A service that streams matches without owning the rights has no place on Google Play, so these apps get passed from hand to hand. To install one, Android first requires you to let WhatsApp, the browser or the file manager “install unknown apps”. That is the first lock, and the user opens it.

The second lock is accessibility, a set of settings designed for people with impaired vision. According to Android’s official help pages, an app granted it can read what is on screen and act on the user’s behalf. For malware, it is a skeleton key: it sees every digit typed and presses the buttons itself.

Then come the tools of the theft itself. Access to SMS and notifications lets the app intercept one-time codes. An overlay places a fake window, identical to your payment app, on top of the real one: the PIN you type goes straight to the fraudster. Google lists four permissions among the most abused (receiving SMS, reading SMS, notification access and accessibility) and says more than 95% of fraud malware families that request them are installed from outside app stores.

A case documented in February by security firm ThreatFabric shows how far this can go. Massiv, a banking trojan disguised as an internet TV (IPTV) app, logs keystrokes, displays fake windows and can stream the screen live to the attacker, or describe each page through accessibility so the attacker can tap buttons and fill in fields remotely, even in apps that block screenshots. The fraudster no longer needs your PIN on their own device: they work on yours.

That matches what Senegal’s police describe: transfers made from the victims’ own phones. Investigators have not named the program involved, however, and there is nothing to suggest that Massiv, whose lures mainly targeted Spain, Portugal, France and Turkey, is circulating in Senegal.

Why football and films make good bait

Anyone looking for a free match has already agreed to step outside official channels: they expect to download a file and click past a warning. According to BleepingComputer, fake IPTV apps had become a markedly more common lure in the eight months before Massiv was discovered. Some even display a real streaming site while the spyware works in the background. The match plays, and the trap stays out of sight.

The calendar helps the crooks: the Champions League phase runs until January 27, 2027, and the European leagues are back every weekend.

Other bait works too. In early 2025, Kaspersky described Tria Stealer, which spread through WhatsApp and Telegram chats disguised as a wedding invitation, sometimes from a friend’s hacked account. Once installed, it took on a gear icon to pass itself off as the phone’s settings, read text messages to harvest codes and tried to hijack messaging accounts to ask contacts for money. Nigeria’s computer emergency response team, ngCERT, issued an alert about it in 2025.

Before you install: six questions to ask

• Where did the link come from? If it arrived by messaging app, text or social media, even from someone close, it deserves no trust. A legitimate app is one you look up yourself on Google Play.
• Does the file end in .apk? On the phone you use for mobile money, don’t open it.
• Are you being asked to allow “unknown sources”, turn off Play Protect or ignore a warning? Stop there.
• Do the permissions match what the app does? A video player needs neither your text messages, nor your call log, nor access to your notifications.
• Does the app insist on accessibility access, or on “allowing restricted settings”, without a clear reason? Google itself lists that request as a red flag.
• Is the offer too good to be true? A paid match for free, a film still in cinemas, money for nothing: these are the very lures the police describe.

Signs an intruder is already there

Spyware wants to be forgotten. Watch for an app whose icon has vanished from the home screen or that mimics a system tool, a battery that drains fast, a phone that runs hot while idle, data use that climbs for no reason.

Other signs are clearer: verification codes you never requested, notifications that disappear before you read them, a screen that lights up on its own. And a transaction you don’t recognise in your account history, which the police advise checking regularly.

Checking an Android phone in ten minutes

Open Settings, Apps, “See all apps”: any name you don’t recognise deserves a look at its permissions. In the permission manager (Settings, Security and privacy, Privacy), the SMS category should list your messaging app, not a video player.

The decisive check is in Settings, Accessibility, under installed or downloaded apps (the label varies by brand): apart from a tool you chose knowingly, nothing should be switched on. Check notification access too, and take away WhatsApp’s and the browser’s right to install unknown apps.

That leaves Play Protect, Google’s scanning system, which is on by default: Play Store, profile icon, Play Protect, Settings, then “Scan apps with Play Protect”. Run a scan. It also checks apps that came from elsewhere and can disable or remove them. An app that asked you to turn it off has already given itself away.

Already installed? What to do, in order

First, cut the connection: airplane mode, wifi off. Without internet access, the attacker loses control of the device. Stop opening your mobile money app on that phone, because a fake window can be laid over it.

Next, from another device, call your provider’s customer service to block the account and change your PIN, using a number taken from its official website, never from a message you received.

Then uninstall the intruder (Settings, Apps, the app, Uninstall). If that fails, Google advises restarting in safe mode (how you do it depends on the manufacturer) and removing recently downloaded apps one at a time. As a last resort, back up your photos and contacts, then factory-reset the phone. Afterwards, turn on WhatsApp’s two-step verification so your account can’t be used to trap the people close to you.

Finally, report it, even if you lost no money: the police ask anyone who installed a suspicious app to come forward quickly and to warn their contacts. Keep a screenshot of the message and the file name.

What about iPhones?

An .apk file won’t install on an iPhone, which in Senegal only accepts apps from the App Store. The risk shifts to fake pages that ask for your PIN and to “configuration profiles” offered by some websites, which Apple requires you to install manually from Settings. To check, go to Settings, General, VPN & Device Management. On a personal phone that section should normally be empty, and an unknown profile can be removed there.

What Google is preparing, and what Senegal is missing

Since 2024 Google has been testing enhanced fraud protection: Play Protect blocks apps that request these sensitive permissions when they are installed from a browser, a messaging app or a file manager. In 2024 the pilots stopped more than 36 million installation attempts on 10 million devices, across nine countries and territories including Kenya, Nigeria and South Africa. Senegal was not on the list published in January 2025.

The second effort goes further. Since September 30, 2026, according to Google’s schedule, Android in Brazil, Indonesia, Singapore and Thailand checks the developer’s identity before installing an app; for an unregistered developer, the user has to go through a longer process. Google plans to extend the check worldwide in 2027. Until then, on a phone sold in Dakar, a file received over WhatsApp installs as soon as its owner says yes to the screens that ask.