Fake EVN Power Company App "CSKH EVNSPC" Warning: Contains Malware and Targets Vietnamese Customers

Vietnam's major power company EVN has warned about fraudulent websites impersonating their brand and a malicious app called "CSKH EVNSPC." The fake app can steal OTP codes, intercept banking credentials, and enable remote control of devices for unauthorized financial transactions.

Scam Overview

EVNSPC, a subsidiary of Vietnam's major power company EVN, has issued a warning about a malicious app impersonating their official customer service application circulating online.

How the Scam Works

Fraudsters employ the following tactics:

Creating Fake Websites
- Replica websites duplicating EVN's official site layout, images, and logos
- Designed to be nearly indistinguishable from legitimate pages
Distributing Unauthorized Apps
- Fraudulent sites display fake Google Play and App Store download buttons
- Direct links to malicious APK files named "CSKH EVNSPC"
- Distribution through unauthorized channels (direct APK file delivery) rather than official app stores

Malware Capabilities

The embedded malware may possess the following functions:

SMS Interception: Capturing OTP (One-Time Password) authentication codes
Phishing Interface: Displaying fake banking login screens to steal credentials
Spyware Functions: Screenshot capture, audio recording, keystroke logging
Remote Access: Enabling remote control of the device

Potential Damages

Using these capabilities, fraudsters can:

Gain unauthorized access to victim's bank accounts
Execute unauthorized fund transfers
Steal and sell personal information

Warning Signs and Identification

Characteristics of Legitimate EVNSPC App:

Available exclusively on Google Play and App Store
Provided directly by EVNSPC (never via APK distribution)
Never sent via email, SMS, or social media links
Clear, verifiable publisher information

Red Flags for Suspicious Apps:

Links received via email or SMS
Requests for direct APK file downloads
Downloads from third-party websites rather than official app stores
Incomplete or unnatural app descriptions
Unclear or missing provider information

Prevention Tips

Use Official Channels Only
- Download apps exclusively from Google Play or App Store
- Never download directly from websites
Verify Link Sources
- Avoid clicking links received via email, SMS, or social media
- Always access official websites directly using bookmarks or browser history
Check App Information
- Always verify the publisher, app name, and reviews before installation
- Confirm the publisher is EVNSPC
Watch for Suspicious Requests
- EVNSPC never sends app links through unofficial channels
- APK installation requests are always fraudulent

If Already Infected

Uninstall Immediately
- Remove suspicious apps without delay
Contact Your Bank
- Notify your bank to temporarily lock your account
- Review all recent transactions
Report to Authorities
- File a report with your local police
- Contact EVN or EVNSPC customer service

Where to Report

Local Police Department (Công An)
EVN/EVNSPC Customer Service
Vietnamese Cybercrime Reporting Agency