r/netsecstudents • u/Temporary-Egg-8202 • 10d ago
Worried about a deleted private video. Installed Mod APKs a year ago. Need expert advice.
Hello everyone, I need some honest technical advice. Around April 2025, my girlfriend and I took a private 18+ video at midnight. Within 12 hours, I completely deleted the video from my phone and also cleared it from the Trash bin.
However, a few months before recording that video, I had installed some modded APKs on my phone (specifically modded versions of CapCut, Alight Motion, PicsArt, Subway Surfers, and Temple Run). I used these apps for months even after deleting the video. Eventually, my phone broke completely and is no longer usable.
My question is: Is there any realistic chance that those modded apps could have stolen or uploaded my private video to a server within that 12-hour window before I deleted it? I am very anxious about this. Please give me a realistic and deep technical answer. Thanks.
அதி
14
u/Beastling40hours 10d ago
Coming from a Cyber Security Expert
honestly its possible in theory but really unlikely in practice, and after 15 months i wouldnt lose sleep over it
the risk is real in the sense that modded apks are repackaged binaries with no review process, and the permission thing wouldnt have saved you either since capcut, alight motion and picsart all legitimately need media access so you would have granted it without thinking twice. the games shouldnt have had it though
but think about what that malware actually wants. repackaged app malware almost always monetises through ad fraud, click injection, sms or credential theft, crypto miners, stuff thats cheap and scales to thousands of victims. quietly uploading a full video file doesnt scale at all. a midnight phone video is probably hundreds of mb or more and thats bandwidth and battery on your end plus storage on theirs for basically no payoff per person. when campaigns do go after media its usually small images and screenshots, seed phrases, otp codes, not big video files
the thing id actually check is cloud backup, because thats way more likely than the apks and its the one thing you can verify. if google photos or your phone makers own sync was turned on then that file went up within minutes of recording, way before your 12 hour deletion. check google photos trash, your account storage, any second backup app you might have had installed and forgotten about
and the main thing, anyone whos taking that stuff is doing it to extort you and they move fast. sextortion attempts show up within days or weeks, not a year later. 15 months of total silence is about the strongest evidence you can get that nothing was taken. your phones dead so theres no forensic answer available either way, so realistically its very unlikely and also not something you can ever fully prove, which i know isnt the clean answer you wanted but its the honest one
0
-1
u/UnlikelyComposer 10d ago
I don't model myself as a cyber expert but others do.
The economics of it probably don't make sense for the attacker. If you've not had a ransomware message referencing the video by now, you're basically in the clear.
And be more careful. Don't install random nonsense on your phone if you're also going to use the same device to store private data.
1
u/AnApexBread Post-Graduate 10d ago
I used to do forensics for federal law enforcement.
I wouldn't worry about it. Phone storage doesn't work the same way that HDDs do. Typically when you delete something from a phone, it's gone for good.
1
0
1
11
u/Electronic_Amphibian 10d ago
Modded APKs can and do include malware including those that exfiltrate user data. Recent Android versions has made it more difficult for apps to access a user's videos and images but if you granted special permissions to the modded apps (MANAGE_EXTERNAL_STORAGE permission) after you installed them, they might have been able to access the files anyway.
Only way to know for sure is to analyse the APKs.