# MA-950.062023: MyCERT Alert - Wedding Invitation "Jemputan Majlis Perkahwinan" Malicious APK

**Date:** 28 Jun 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-950.062023  
**Advisory ID:** MA-950.062023

---

**1.0 Introduction**
Recently, MyCERT observed cybercriminals had exploited a malicious android application in a "Wedding Invitation" or “Jemputan Majlis Perkahwinan” malware campaign targeting internet users in Malaysia. The Wedding Invitation Scam preys on people's excitement about wedding invitations. Cybercriminals use text messages sent via instant messaging apps such as WhatsApp to trick victims into installing a malicious APK on their devices that can steal their personal information.
**2.0 Impact**
Financial loss and disclosure of personal information. An APK is a file format used by the Android operating system for the distribution and installation of mobile apps, usually via Google Play Store. The APK files allow the perpetrators to steal data from users' mobile phones, including users' TAC numbers which enables them to make unauthorised banking transactions from victims' bank accounts.
**3.0 Affected System and Devices**
Android mobile devices.
**4.0 Other 
Below are references of similar incidents:
- [MA-834.052022: MyCERT Alert - SMSSpy campaign to steal Malaysian banking user credential](https://www.mycert.org.my/portal/advisory?id=MA-834.052022)
- [MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme](https://www.mycert.org.my/portal/advisory?id=MA-790.072020)
- [MA-695.012018: MyCERT Alert - Fake Bank Negara Malicious APK - New Variant](https://www.mycert.org.my/portal/advisory?id=MA-695.012018)
- [MA-694.012018: MyCERT Alert - Fake Bank Negara Malicious APK](https://www.mycert.org.my/portal/advisory?id=MA-694.012018)
**5.0 Recommendations**
The application is meant to retrieve information from the victim’s phone and could be used for other malicious purposes. As a CERT, we would highly recommend the followings:
• Verify application permission and the application author or publisher before installing it.
• Avoid side loading (installing from non-official sources) when you can. If you do need to install Android software from a source other than the trusted marketplace, be sure that it is coming from a reputable source.
• Do not click on adware or suspicious URL sent through SMS/messaging services.
• Malicious programs could be attached to collect users' information.
• Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
• Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.
• Do not root or 'Jailbreak' your phone.
• Contact relevant authorities and report to the National Scam Response Centre at 997 for any inquiries and assistance 
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, don't hesitate to get in touch with MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
- [MA-834.052022: MyCERT Alert - SMSSpy campaign to steal Malaysian banking user credential](https://www.mycert.org.my/portal/advisory?id=MA-834.052022)
- [MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme](https://www.mycert.org.my/portal/advisory?id=MA-790.072020)
- [MA-695.012018: MyCERT Alert - Fake Bank Negara Malicious APK - New Variant](https://www.mycert.org.my/portal/advisory?id=MA-695.012018)
- [MA-694.012018: MyCERT Alert - Fake Bank Negara Malicious APK](https://www.mycert.org.my/portal/advisory?id=MA-694.012018)
- <https://www.nst.com.my/news/nst-viral/2023/06/921637/nstviral-watch-out-wedding-invitation-scam>
- <https://www.buletintv3.my/nasional/kad-kahwin-digital-taktik-baru-scammer-kebas-duit-warga-emas1111/>