Cybercriminals are once again exploiting the festive, as we head into the new year 2026, to target unsuspecting smartphone users in India. A new scam is to be doing the rounds, which claims to let users create personalise New Year greeting cards.
But, it delivers a malicious APK file which can compromise smartphones to steal personal information, cause financial losses, and compromise user privacy.
The advisory, issue by the Hyderabad Cyber Crimes Unit, mentions that the fraudulent links are being widely circulated via WhatsApp, SMS, and social media platforms.
⚠️ Scam Alert! Messages offering a “personalized” New Year card via links or .apk files can install malware. Don’t click, don’t download—report & block immediately. Stay alert this festive season! 🎁📱 #CyberSecurity #WhatsAppScam #1930 #cybercrimespshyderabad #onlinesafety… pic.twitter.com/Gc1jKjaPsF
— Cyber Crimes Unit Hyderabad (@CyberCrimeshyd) December 31, 2025
How New Year 2026 Scam Happens?
As per the advisory, the New Year greeting scam is design to prey on unsuspecting users who simply want to share New Year wishes with friends and family.
You typically receive a message via SMS or WhatsApp, which prompts them to tap a link to generate a personalise New Year greeting card with their name or photos.
If you clicks on the link, they are redirect to a webpage that prompts them to download an APK file, which is disguise with festive names such as Happy New Year.apk.
As it may appear harmless, installing the APK can inject malware and give threat actors access to sensitive information store on the device, turning a simple attempt to send a New Year greeting into a financial and privacy risk with serious consequences.
As per the Hyderabad Cyber Crimes Unit, cybercriminals can leverage this scam to steal your personal and banking data, compromise user privacy, install malware on the phone, and even provide cybercriminals control of the device.
How to Protect Yourself from New Year 2026 Scam?
- Avoid clicking on unknown links
- Never install APK files from messages or an unknown source
- Download apps only from official sources, like the Google Play Store
- Verify before trusting apps with their data
If you suspect they have encounter or fallen victim to the New Year greeting scam, they are recommend to contact the national cybercrime helpline at 1930 or file a complaint online via the cybercrime.gov.in portal.
Prompt reporting can help limit financial losses and aid investigations, as per the cybercrimes unit.
What is GhostPairing Attack on WhatsApp?
In recent time, security researchers have also warn about another cyber campaign call as GhostPairing.
As it is claim to allow attackers to silently take over WhatsApp accounts without compromising passwords or attempting SIM-swapping techniques.
As per reports, it exploits the device linking capability of WhatsApp to trick users into approving a malicious device linkage.
While device linking usually happens via either QR code or numeric pairing code, researchers suggest that the latter is more common.
This usually begins with a short message received by users from a contact, which contains a link directing them to a Facebook photo.
When click, it redirects them to a spoof Facebook login page that asks for their login credentials, such as a phone number.
The next screen allegedly shows a numeric code, with instructions guiding them to enter it on WhatsApp.
Or, the attacker’s browser gets add as a link device to the victim’s account.
