I4C Asks Google to Remove 8 Predatory Loan Apps That Harvested Contacts and Extorted Indian Borrowers With Morphed Photos; Copycats Still on Play

NEW DELHI, Nov 11: India's Indian Cyber Crime Coordination Centre (I4C) has asked Google to remove eight personal-loan apps from the Play Store. Victims say the apps cut about 40% from loans upfront, demanded repayment in 7 days instead of the advertised 91 to 365 days, and then threatened borrowers and their contacts with morphed photos. All eight apps were gone from Google Play on 11 November. A technical review of the apps' servers and code shows the eight belong to three separate operations, not one. One group's software was written by Chinese-speaking developers and carries a hidden "silent photography" function. Look-alike apps from two of the groups are still live on the Play Store.

The request was reviewed on Lumen Database, the Harvard-run archive of removal sent by I4C to Google on 5 November 2026. It names eight Play Store packages:

• com.satyamang.vriddhi.app (Satyamangalam Vriddhi)
• com.dharmaflow.revolvingcredit.app (DharmaFlow - Revolving Credit)
• com.anantapurchakra.flexicredit.app (Anantapur Chakra - Flexi Credit)
• com.urban.gullak.app (UrbanGullak)
• com.rupeeflow.creditpath (RupeeFlow - Cash Out Anytime)
• com.rupeeflow.app (RupeeFlow)
• com.nexlimit.creditline (NexLimit - Credit Intermediary)
• com.flexibee.flexibee (FlexiBee : Secure Data Loan)

All lending apps have been taken down by Google as of today. I4C notifies the unlawful content to Google and other intermediaries through its Sahyog Portal. IT Rules 2021 are invoked for the same.

Three operations

No copy of any of the eight app files (APKs) could be found on public mirrors. The analysis therefore covers what the apps loaded from their own servers, their privacy policies, Play listings archived by app trackers, and the hosting behind them.

The apps fall into three groups with no technical link between them, other than the same victim pattern and the same takedown notice:

• Group A, four apps: Satyamangalam Vriddhi, DharmaFlow, Anantapur Chakra and UrbanGullak. They share one loan web front-end, one privacy-policy template and one hosting set-up: a separate Amazon Web Services server in Mumbai for each app, managed with the aaPanel (宝塔, BaoTa) hosting panel.
• Group B, three apps: the two RupeeFlow packages and NexLimit. They share listing text, a domain registrar, Cloudflare accounts and data servers on Huawei Cloud in Jakarta, Indonesia.
• Group C, one app: FlexiBee, a lending app run for an RBI-registered non-banking finance company (NBFC).

Group A: one codebase behind four "Indian" brands

The four apps carried Sanskrit- and Hindi-flavoured names and were listed under developer identities that appear to have been borrowed or impersonated: an education company in Tamil Nadu, a software firm in Bengaluru, a US limited liability company whose Play account had previously published games, and a lender registered in the Philippines. These entities may themselves be victims of identity misuse; no finding of wrongdoing is made against them. Satyamangalam Vriddhi, the biggest, had more than 500,000 installs and was listed as a credit-card "tracker" rather than a loan app.

Each app loaded its screens from a web server it controlled. Anantapur Chakra and UrbanGullak served a byte-identical JavaScript file (app.a0aad2d7.js), and Satyamangalam Vriddhi served a second build (app.93192aa9.js). This was confirmed by matching SHA-256 hashes on 11 November. The code shows:

• Chinese-language developer messages. The code contains about 20 Chinese log messages, for example 开关开启，进入 KYC 主路径后开始录屏 ("switch on: start screen recording after entering the KYC main path").
• Pinyin function names. Examples are huoQuDaiHuanKuanInfo ("get repayment-due info"), /user/txl/saveLianXiRenList ("save contact list", where txl stands for 通讯录, address book) and shangChuanUtr ("upload UTR").
• Full session recording. Alibaba Cloud's ARMS real-user monitoring is set to replay 100% of sessions through the KYC steps (face, contacts, personal details, bank account). The bundled software development kit defaults to Alibaba's cn-hangzhou region.
• A silent photo. A function named silentPhotography() fires a native camera call the first time the user types into the personal-details form. The name and trigger point to a covert front-camera capture. This is an inference from the code; the app itself could not be tested.
• Contacts from the address book. "Emergency contacts" are picked from the phone's address book and uploaded.
• Loans paid out automatically. An "Automatic Loan Disbursement Agreement" says that "if no amount is specified, the system will default to the maximum eligible loan amount", and that borrowers who do not want the money must ask for a refund "within 24 hours".
• A Telegram "earning" page. It reads "REGISTER, LINK UPI, GET PAID … Trading Income: Earn 3% per order, Daily Up To ₹6,100". This matches the usual pitch used to rent people's UPI IDs for moving other people's money, so the page is suspected to be recruiting money mules. Its purpose has not been confirmed.
• Cross-selling. "Loan supermarket" and "old customer diversion" functions push existing borrowers to sister apps.

The privacy policies of the Group A apps use the same line: "To avoid leakage and misuse of this information, we will transfer user data to the following address", followed by a "ce." subdomain of each app's website.

The servers were moved to new AWS addresses after the notice. Three Group A hosts that were checked on 3 November had different IP addresses on 11 November.

Group B: revolving-credit apps with data servers in Jakarta

RupeeFlow - Cash Out Anytime was listed by Robosonic Tech Services LLP of Thane, Maharashtra. It had more than 100,000 installs on Play, and about 280,000 according to the tracker AppBrain. NexLimit was listed under the name of an individual in Lima, Peru, whose website presents itself as a tyre-repair business. It had more than 50,000 installs. No metadata could be recovered for the second RupeeFlow package, com.rupeeflow.app, so it is linked to this group by name alone.

Both listings called the product a "revolving credit line" and used the same worked example: Rs 10,000 over 120 days, with "≈2,650 INR" a month and 10,600 INR in total. RupeeFlow advertised terms of 91 to 365 days. NexLimit advertised a minimum of 60 days, which falls inside Google Play's ban on personal loans that must be repaid in full within 60 days or less.

The two operations share three matching pairs of Cloudflare nameservers across matching domains: the brand websites, the developer websites and the data servers. Because Cloudflare assigns nameserver pairs per account, three matches point strongly to a single operator. This is an analyst's inference.

Both privacy policies say users' data is uploaded to a "Security Center" or "secure server" host (ictiveli.flowcreditoffcial.com for RupeeFlow and icsrece.nettrickforcesupply.com for NexLimit). Both hosts are on Huawei Cloud in Jakarta (AS136907). The policies describe collecting:

• the content of financial SMS messages
• the list of installed apps
• the Google advertising ID
• for RupeeFlow, call logs during "voice verification"

RBI's Digital Lending Directions bar lending apps from accessing call logs and contacts.

Robosonic Tech Services LLP is named here only as the developer listed on Google Play. No finding of wrongdoing is made against it. Its Play developer page now returns "Not found".

Group C: an RBI-registered lender's app

FlexiBee : Secure Data Loan was published by Flexifintech Soluastion Private Limited (the spelling used on Play) as the lending service provider for Vaishali Securities Limited. The listing advertised loans of Rs 6,000 to Rs 70,000 over 91 to 240 days at an annual percentage rate (APR) of 20% to 24%. Google Play showed more than 1,000,000 installs; AppBrain estimates 2.5 million.

Vaishali Securities Limited appears in RBI's list of registered NBFCs as of 30 September 2026. It is a non-deposit-taking investment and credit company in the "Base" layer, under RBI's Ahmedabad regional office. A third-party copy of RBI's digital lending apps directory, checked on 9 November, lists FlexiBee under Vaishali Securities, with Flexifintech as the service provider. RBI's own directory page could not be loaded at the time of writing.

FlexiBee's terms look compliant on paper, but I4C still targeted it. Dainik Bhaskar reported on 4 October that police in Indore had registered a case over a FlexiBee loan, set out under "Victims" below. No app file for the original FlexiBee could be obtained. Its replacement, FlexiBee - Pro, is examined below.

A new app from the same developer, FlexiBee - Pro (com.beeflexi.beeflexi), appeared on Play on 4 November, one day before the I4C notice. By 11 November it had more than 1,000 installs and 507 ratings averaging 4.4. Its Play "Data safety" section says "No data collected". A review on the listing says, in Hindi: "Bina OTP ke mere account me Loan amount ko Transfer kar diya gaya" ("the loan amount was transferred to my account without an OTP").

How Google playstore due-diligence is bypassed

1. Front identities. The operators use Play developer accounts in the names of real small Indian firms, a co-operative bank, a US LLC, a Philippine lender, a Peruvian individual or an Indian LLP. Some of these accounts were first warmed up with filler apps.
2. Disguised listings. The apps are described as a "credit-card tracker", "Hisaab" (accounts book) or "revolving credit assistant" rather than a loan app. Ratings are hidden or padded with one-word five-star reviews.
3. Ads. Meta ads run from throwaway pages promise "NO CIBIL REQUIRED", terms of 91 days or more, and daily rates as low as 0.03%.
4. Data capture. The apps collect KYC and liveness checks, address-book contacts, installed apps and, in Group B and the live Group A look-alikes, SMS. Group A adds a silent photo and full session recording.
5. Predatory loans. About 40% is deducted upfront and the real term is 7 days. In Group A, the "scheduled loan" feature disburses the maximum amount by default.
6. Extortion. Calls start one or two days before the due date. Messages and morphed or nude images go to the borrower's contacts. Repayment is taken through payment links or personal UPI IDs and QR codes chosen by the server.
7. Recycling. Borrowers are pushed to sister apps. In Group A, they are also offered the Telegram "Link UPI, earn 3%" scheme.
8. Resilience. Replacement apps are staged in advance, and servers move to new IP addresses within days of a takedown.

Victims

In a sample of 293 one- and two-star Play reviews of Satyamangalam Vriddhi collected on 3 November, borrowers described:

• a 7-day repayment term (28 reviews)
• a fee of about 40% (29), for example Rs 4,000 kept from a Rs 10,000 loan
• harassment (47)
• messages to their contacts (29)
• morphed photos (22)

Reviews of RupeeFlow from 31 October complained of the same 7-day term, of loans "auto-approved" for only part of the amount, and of "two additional loan accounts created without consent". One reviewer wrote that the operators "start sending nudes" two days before the due date.

Indore: Dainik Bhaskar reported on 4 October 2026 that Banganga police in Indore had registered a case on a young woman's complaint. In July she had taken Rs 5,800 through the FLEXIBEE app and Rs 10,900 through an app called CASHTOYOU. The fraudsters copied her photos and contact list and sent obscene edited photos of her to relatives and acquaintances. Between 23 July and 29 August she was pressured into making about 71 transactions to various UPI IDs and QR codes, from her own and her mother's bank accounts, totalling Rs 3,07,000. She still receives threats, according to the report. It does not give the app's package name.

Hyderabad: The New Indian Express reported on 11 November 2026 that a 31-year-old constable of the 3rd Battalion had died by suicide after loan-app operators threatened to circulate morphed photographs of him and his family. Relatives found that he had borrowed Rs 40,000 through "the Rupee Flow loan application" and had received morphed photos of his aunt with threats. The report says he had earlier borrowed through loan apps to fund online betting. Pahadishareef police have registered a case. The report names the brand only. It has not been established that the app was com.rupeeflow.creditpath or com.rupeeflow.app from the I4C notice.

Technical analysis of Look-alike live apps

The five look-alike apps still on Play were downloaded from Google Play's own delivery servers on 11 November. They were examined without being installed or run. Their manifests and code confirm what the server-side front-end showed, and add to it.

Group A look-alikes (ShriCredit Tracker, ShriAroh Gati, Pahiya Credit and SriVridhi Hisaab):

• Same kit. ShriCredit Tracker loads its screens from code.shricredittracker.com. That server delivers a JavaScript file byte-identical to the one behind Satyamangalam Vriddhi, an app named in the I4C notice. ShriCredit and ShriAroh hard-code a "ce." server. They hand contacts and ID photos back to the web page through functions (getContactData, resultFrontFile, permissionAllow) that also appear in that front-end. Pahiya and SriVridhi hard-code code.pahiyacredit.com and rest.sribachathisaab.com. They register numbered bridge handlers (30045-… and 30032-…) that match the front-end's "app code" calls.
• A camera routine behind the silent photo. Pahiya and SriVridhi contain a routine named _silentTakePicture and a "quite_photo_upload" data object. These give the front-end's silentPhotography() call a camera function on the phone to trigger.
• SMS and phone data. All four request permission to read SMS (READ_SMS) and app-usage data (PACKAGE_USAGE_STATS). ShriCredit and ShriAroh also request the call log, and Pahiya and SriVridhi request external storage.
• Pahiya and SriVridhi store SMS records including the message body. A filter keeps messages containing words such as "loan", "utr", "overdue", "debit", "debt", "deposit" and "borrow", in other words a borrower's financial SMS, including dues owed to other lenders. SriVridhi also contains a file named sms_upload.dart.
• The code also reads the installed-app list and Wi-Fi, GPS, sensor and emulator details.
• None of the four declares contacts access (READ_CONTACTS). Contacts are picked one at a time through the phone's contact picker and passed to the web page.
• Chinese in the apps' own code. Pahiya and SriVridhi use pinyin file and function names such as qidongye (启动页, "splash page"), quanxianshengming (权限声明, "permission statement") and huoQu (获取, "get"). They contain the Chinese error message 设备信息获取失败 ("failed to get device information"). ShriCredit and ShriAroh contain 选择文件 ("choose file").
• Numbered builds. Pahiya and SriVridhi are the same Flutter project, built under the internal names t45 and t32 with app codes 30045 and 30032. That suggests a numbered series of builds of the kit; how many exist is not known.

FlexiBee - Pro (Group C):

• Data collection. Its Play listing says "No data collected". Its code collects the installed-app list, device and hardware details, sensor data and coarse location, and captures face images during a liveness check.
• Chinese SDKs. The liveness check uses a software kit from DeepFinch (深智恒际), a Beijing company. In-app support runs on AIHelp, whose mainland Chinese company is registered in Beijing and which describes itself as headquartered in Singapore.
• Chinese in its code. It logs a Chinese heading, 安全检测结果 ("security check result"), and contains a table of mainland Chinese and Taiwanese mobile carriers.
• Anti-analysis checks. It looks for the Chinese traffic-capture and modding tools HttpCanary and MT Manager, and tests for DNS tampering by looking up baidu.com, qq.com and aliyun.com.
• Separate infrastructure. It uses its own API (api.flexibeepro.in, on AWS Mumbai) and shows no technical link to Group A or Group B.

Policy.

• Google Play. Play bars personal-loan apps from accessing sensitive data such as contacts and photos, and lists external-storage access among the prohibited permissions. Its separate SMS and call-log policy limits those permissions to apps whose core function needs them.
• Disguised listings. The Group A look-alikes are listed as a credit "tracker", a "hisaab" (ledger) and an "auto loan" app. Car loans fall outside Play's definition of a personal loan.
• RBI. RBI's Digital Lending Directions bar lenders' apps from accessing contacts, media and call logs.

Copycats still on Google Play (checked 11 Nov 2026)

ShriCredit Tracker and ShriAroh Gati are listed under the name of a co-operative bank, which appears to have been impersonated. Vaishali Securities' own app ZingLoan (com.zingloan.zingloan), which was not in the notice, is also live. One consumer-forum complaint, which has not been verified, names it among apps whose agents made harassing calls.

Who is behind it

The evidence supports saying that Group A's software was built by Chinese-speaking developers. Chinese log and error messages and pinyin names appear both in the web front-end and in the apps that load it, alongside Chinese cloud tools (Alibaba Cloud ARMS and aaPanel/BaoTa). FlexiBee - Pro, the replacement for FlexiBee, uses two kits from Beijing-based companies, logs in Chinese and is built to detect Chinese hacking tools. That points to Chinese tooling or a Chinese-speaking development team. Group B stores its users' data on Huawei Cloud servers in Jakarta. None of this proves that any named company is Chinese-owned or controlled. The developer names, domains and payment channels are Indian or offshore fronts. No technical link was found between the three groups.

How to protect yourself

• Before borrowing, check the app and the lender named inside it against RBI's directory at rbi.org.in, under Citizen's Corner, "DLA's deployed by Regulated Entities". A listing only shows that a regulated entity has reported the app. It is not RBI approval, and this case shows that a listed app can still be targeted by I4C.
• Do not install loan apps that ask for access to contacts, photos, call logs or SMS. RBI rules bar lending apps from accessing contacts, media and call logs.
• Be wary of any app that pays money into your account without asking. Do not use a payment link or personal UPI ID sent by a "recovery agent".
• Never link your UPI ID to "earn per order" schemes. You could end up moving fraud proceeds.
• If you are threatened, do not pay. Call the National Cybercrime Helpline on 1930 or report at cybercrime.gov.in, and file a police complaint. Complaints about a regulated lender can also go to RBI's complaint portal at cms.rbi.org.in.

Method and limits

All checks were read-only. The eight apps in the notice could not be obtained, so their signing certificates, permissions and SDKs could not be checked. The five look-alike apps still on Play were downloaded from Google Play's delivery servers on 11 November and analysed statically, without being installed or run. Nothing was uploaded to third-party scanners. Four of these apps use code protection that hides part of their logic. The review counts come from a sample collected on 3 November, before the apps were removed. Groupings are based on shared code, hosting and registration records, and represent analytical judgement.

Other indicators:

• Group A front-end SHA-256 hashes:
• 288267dfa191f5b3bf4222e6c233926813da8d3cd89cf6a95381fc310a48f10d (app.a0aad2d7.js)
• 823f80a6eabe53f286e6ad42c7c1ce30e73f779d296295bc5e344f84ccb4300d (app.93192aa9.js)
• Group A previous IPs (3 Nov): 13.126.221.181, 13.205.39.166, 3.108.215.23
• Group B Cloudflare nameserver pairs: ryan/sima, braelyn/pedro, olga/syeef
• FlexiBee - Pro API: api.flexibeepro.in and api.flexibeepro.asia → 15.207.57.234, 16.4.118.216 (AWS ap-south-1)
• Live look-alike base.apk SHA-256 hashes:
• com.beeflexi.beeflexi 1.0.2: 0d73b72121231d8d688caf859b1e0d815180f12df1fa43dd33135f88eaaa33fd
• com.shricredit.tracker.app 1.0.2: c0be3bf1318d7d8a21cf118836ecbb5369609cc5836fd2aa23c6860cd9331dbe
• com.shriarohpay.gatikit.app 1.0.102: 53b0b54e568444d9fd43dbedf3f86f731f6c1b90b96d402ddc632c49468be3a8
• com.pahiyacreditpay.wheellane.app 1.0.0: aeac7413fc85e0c3cb365dc7cef9d10251b55d492d1fe1eb8b5b05330570f594
• com.srivridhi.hisaabbook.app 1.0.1: 2d5366ebaef4cd2c8082846845bfaa476ad93bb24ff9fcbafb3a0204d26243b5

Indicators of compromise