Meta has moved swiftly to remove dozens of fraudulent advertisements from its platforms after Indian authorities raised alarm over a coordinated scam exploiting sexually explicit content to distribute banking malware. The action marks renewed pressure on the technology giant to police malicious activity across Facebook and Instagram, even as cybercriminals find increasingly sophisticated ways to exploit the platforms' advertising systems to target users in one of the world's fastest-growing digital economies.
India's government flagged the scheme on Monday, identifying a network of apps operating under names such as "Night Play" and "Kyss" that presented themselves as adult entertainment services but actually functioned as trojan horses for credential-harvesting malware. Once installed on users' devices, these applications could intercept one-time passwords, capture banking PINs, and transfer funds directly from compromised accounts without the owner's consent. The discovery underscores how cybercriminals are weaponising the intersection of human vulnerability and technological sophistication to extract wealth from India's booming digital-payment ecosystem.
The scale of India's cybercrime losses illustrates the stakes at hand. Government data reveals that India suffered nearly $2.4 billion in cyber-fraud losses during 2025 alone, a figure that reflects the systematic targeting of a nation where digital payment adoption has accelerated dramatically over the past five years. As more Indians embrace mobile wallets, banking apps, and online transaction platforms, scam networks have rapidly adapted their techniques to match this transition. The malware-laden advertisements spotted on Meta's platforms represent a particularly insidious form of attack, weaponising the very visual appeal and algorithmic targeting that makes social media advertising effective.
The extent of the problem became evident when independent reporting identified at least 39 such malicious advertisements still active on Facebook and Instagram even after the government's advisory was circulated. Many of these ads deployed sexually explicit video thumbnails as bait, exploiting predictable user behaviour to generate clicks that would redirect victims to phishing pages. Only after journalists brought the matter directly to Meta's attention did the company move to strip all of these advertisements from its platforms, raising questions about the efficacy of Meta's vaunted content-moderation systems and their responsiveness to government warnings.
Meta's stated advertising policies explicitly prohibit placements that "contain adult nudity and sexual activity" and ban promotional material for "products, services, schemes or offers using identified deceptive or misleading practices." On paper, these guardrails should have prevented the fraudulent apps from ever appearing on the platform. Yet the persistence of dozens of such advertisements suggests that enforcement mechanisms remain porous, particularly when sophisticated operators deliberately obscure the true nature of their offerings. The gap between Meta's policy commitments and actual implementation reflects a broader industry challenge: the sheer volume of content, combined with the profit incentives embedded in ad-serving systems, often outpaces the capacity for meaningful human review.
This incident is not isolated. Just weeks earlier, Indian authorities had directed Google to shut down hundreds of accounts operating on its Firebase platform, which criminals were exploiting to impersonate major Indian banks and conduct phishing campaigns. The recurring pattern of major technology platforms becoming vectors for large-scale financial fraud suggests that security vulnerabilities exist not merely at the edges of these systems but are embedded within their core advertising and hosting infrastructure. For technology companies, the challenge remains acute: balancing growth and profitability with the security obligations owed to users in emerging markets where digital literacy varies widely and financial systems remain vulnerable to technological exploitation.
The economic dimensions of Meta's permissiveness toward fraudulent advertising are striking. Reporting revealed that Meta had internally projected scam and banned-goods advertising to generate approximately 10% of its 2024 revenue, translating to roughly $16 billion annually. This projection suggests that even as the company publicly emphasises its crackdown on malicious content, internal calculations acknowledge that such material generates material revenue. The tension between public commitments and private financial incentives creates a structural pressure that tends to favour under-enforcement, particularly when violations originate from regions with weaker regulatory oversight.
One particularly revealing example illustrates the modus operandi. An advertisement for a supposed video app promised users access to extensive pornographic content updated around the clock. Victims were directed to download an application file named "Movexa.apk" directly, circumventing Google Play Store safeguards that might have caught the malicious code. Once installed, the application could request permissions to access stored data, intercept authentication messages, and initiate financial transactions. This technique exploits the technical illiteracy of many users, who may not understand the permissions they are granting or the difference between downloading from official repositories versus sideloading unverified applications.
For Malaysian and Southeast Asian readers, the implications cut across multiple dimensions. Regional digital-payments adoption mirrors India's trajectory, meaning similar malware-distribution schemes could target local banking systems and payment platforms. Malaysia's own mobile wallet and e-commerce ecosystem has expanded substantially, creating an expanding surface area for cybercriminals to exploit. The revelation that Meta's content-moderation systems allowed fraudulent advertisements to proliferate for extended periods should prompt regional regulators to examine whether similar schemes currently operate across Malaysian Facebook and Instagram platforms.
The incident also highlights the asymmetry between the resources available to major platforms for security and the ingenuity of criminal networks. Meta employs thousands of content moderators worldwide, yet a handful of journalists identified dozens of active fraudulent advertisements that the company's systems had missed. This disparity suggests that technological solutions alone cannot solve the problem; meaningful enforcement requires genuine commitment to removing profitable vectors for criminal activity, even when that removal translates to forgone advertising revenue.
Regulatory responses will likely intensify across the region. Indian authorities have demonstrated willingness to demand platform accountability, and their actions may embolden similar interventions by Southeast Asian governments seeking to protect citizens from technology-enabled financial fraud. For Meta and other platforms, the cost of non-compliance—including potential restrictions on operations or advertising capabilities—may eventually exceed the revenue generated by overlooking malicious content. Whether such economic pressure can overcome structural incentives favouring permissiveness remains an open question.
The broader pattern emerging across multiple technology platforms suggests that financial fraud and malware distribution have become endemic features of digital advertising ecosystems, not aberrations to be corrected through marginal adjustments. Until platforms systematically prioritise user security over short-term revenue maximisation, similar schemes will likely persist, adapting their techniques to exploit new loopholes as old ones are closed. For Southeast Asian users and policymakers, sustained vigilance and regulatory pressure represent the most reliable tools for constraining these threats.
