BENGALURU — Cybercriminals have discovered the single most effective vector for attacking Indian mobile phone users: the wedding invitation. Thousands of Bengaluru residents have received WhatsApp messages from unknown numbers containing what appears to be a wedding invitation — a PDF titled something like "Sharma_Wedding_Invitation.pdf" or "Riya_Weds_Rohan_Invite.apk" — that is actually a malicious APK file. Those who clicked it and installed it handed the attackers full access to their contacts, messages, photos, and in many cases their banking applications.

The scam is elegant in its cultural specificity. In India, wedding invitations arrive from numbers you don't recognise because the bride or groom's cousin who has been tasked with digital distribution has your number from a shaadi.com inquiry in 2019 and has never spoken to you since. You do not question the unknown number. You do not question the PDF. You open it because you have been opening wedding invitations from unknown numbers your entire adult life and there has never been malware in one before. Until now. Congratulations, cybercriminals. You have studied us.

The Bengaluru Cyber Crime police have issued an advisory: do not open APK files received on WhatsApp, even if they appear to be from known contacts, even if they appear to be wedding invitations, even if the Ganesha looks legitimate. Indians are being asked to be suspicious of wedding invitations. This is the most psychologically complex cybercrime advisory ever issued. The police know this. They issued it anyway. They had no choice. The malware is in the mandap.