Indian users are losing money without sharing OTPs. APK malware silently hijacks phones and drains accounts.