As India gears up to welcome 2026, the Telangana Cyber Security Bureau (TGCSB) has issued a warning about a rising threat of “Greeting Scams” circulating on messaging platforms like WhatsApp and Telegram. These scams exploit festive trust, luring users into clicking links that promise personalized greetings, New Year gifts, or SBI year-end rewards.
Unlike typical frauds, these attacks do not rely on fear or greed but exploit the goodwill of users. Often, the messages appear to come from a trusted contact whose account has already been compromised, making the scam appear legitimate.
How the Scam Works
When a user clicks on the link, instead of a festive animation, a malicious APK (Android Package Kit) file is installed silently on the device. Once activated, this malware gives hackers near-total control over the victim’s digital life, including access to contacts, photo galleries, microphones, and messages. It can even bypass two-factor authentication for banking apps.
Hackers then hijack the victim’s WhatsApp account to forward the malicious link to all contacts, perpetuating the cycle. Because these links are often shared in family or office groups, users may let their guard down, unaware that they are effectively giving attackers access to sensitive information.
Shikha Goel, head of TGCSB, said, “People believe they are opening a greeting card, but in reality, they are handing over the keys to their bank account.”
TGCSB Guidelines to Stay Safe
To avoid falling victim, TGCSB advises users to:
- Avoid clicking unknown links, even if sent by friends or family.
- Block and avoid installing APK files from private messages.
- Enable two-step verification on messaging apps to prevent account hijacking.
- Update apps only from official stores such as Google Play Store or Apple App Store.
Act immediately if a suspicious link is clicked: disconnect from the internet, uninstall the app, and notify your bank.
Victims are encouraged to report cybercrime within the first hour, as early reporting improves the chances of freezing compromised funds. Complaints can be registered via 1930. The TGCSB reminds citizens to remain vigilant and practice digital hygiene to ensure a safe and secure start to the New Year.
