A routine complaint from a parent has led a Belagavi-based IT professional to detect a malicious steaming mobile application that seems to be spreading fast among youngsters.

Swapneel Patnekar, who is the founder of cybersecurity and threat intelligence company, Shreshta IT Technologies Pvt. Ltd., began working on Pikashow, an app offering free streaming of films, web series, sports and live television, after a parent complained to him that his children and their friends were addicted to it.

After working for months and amassing and studying a lot of data, Shreshta has raised serious cybersecurity concerns.

It has cautioned users against installing the app, while warning that it may expose devices to malware and compromise sensitive personal data.

Shreshta has shared a detailed report with the Central and State governments.

“One of the concerns is that Pikashow is run by several people whose accounts originate in Pakistan. They may be leading a campaign aimed at spreading malicious software and targeting Indian users. The first step is to uninstall the application immediately,” Mr. Patnekar said.

He said that unlike legitimate platforms, Pikashow is not available on the Google Play Store and must be downloaded through APK files from third party websites, a process known as sideloading.

“This violates standard security checks, significantly increasing the risk of malware infections. It seems a lot of users are attracted to the free streaming offered here. But such tools can expose users to severe financial and data risks,” he said.

Once installed, sensitive information, including UPI PINs, passwords, one-time passwords (OTPs), photos, messages and contacts may be silently extracted, while the device continues to function normally, making detection difficult.

In addition to cybersecurity threats, accessing pirated content through such platforms is illegal under Indian Copyright laws and may invite legal consequences.

Researchers at Shrestha Technologies have identified 316 domains associated with the operation with at least 22 websites actively distributing different versions of the app as of January 2026.

A report has been sent to the Indian Cyber Crime Coordination Centre (I4C) and the State Police, he said.

Some users and influencers are spreading the app by writing reviews and giving good ratings on platforms like X.

But most of them seem fake and the work seems to be coordinated or spread through a single network.

Users are strongly advised to download applications only from trusted sources such as the Google Play Store or the Apple App Store, where apps undergo security verification.

Those who have already installed Pikashow or similar applications should delete them immediately, change banking and UPI credentials and monitor their financial accounts for any suspicious activity.

Victims of cyber fraud or suspected device compromise can report incidents via the national cybercrime helpline (1930) or through the official portal, cybercrime.gov.in, Mr. Patnekar said.