Is Ganxora a scam? The task app that hijacks WhatsApp

Ganxora bills itself as a way to "make money with WhatsApp tasks straight from your phone": R$ 3 on sign-up, "no deposit", tasks lasting one to three minutes ("forward messages, add contacts, join groups"), Pix withdrawals from R$ 5 and a 20% commission on the earnings of anyone the participant refers. The site's shop window cites 120,000 users, R$ 2.5 million paid out and 98% satisfaction, with no source. The domain ganxora.com has existed since 19 September 2026; the mirror ganxera.com, which the platform itself treats as an official address, since 5 October. This page began with a no-result query in CyberX's scam search on 9 October 2026, run against an invitation link from the platform.

The small payments are real. In the videos and "side income" channels that promote Ganxora with a referral code, R$ 5 and R$ 10 withdrawals show up paid by Pix within a minute or two. That is the hook. What the user hands over in return is what this page describes.

What the app actually does

Ganxora is not on Google Play. The website does not serve the app; it is the platform's API that delivers an APK for manual installation, with the internal package name com.venus.tools.brazil, hosted on the domain of a sibling brand from Bangladesh. Web sign-up is switched off in the platform's configuration: the entire flow happens inside the app.

Inside the app, the "task" begins when the user links their own WhatsApp. The platform's official tutorial, narrated in Portuguese, walks through generating an eight-character authorisation code in the app and pasting it into WhatsApp's Linked devices screen. Once that is done, the app operates the account as if it were a WhatsApp Web session: in the user's device list it appears as "Google Chrome (Mac OS)". The platform configuration records that tasks start after this pairing, and ships with a toggle to wipe WhatsApp history switched on.

The task, as seen on participants' phones, is the user's own WhatsApp firing off a bait message ("Your reward has arrived! Make s…") to lists of numbers across multiple area codes, one every thirty seconds, while the notification "Ganxora: awaiting task execution" sits pinned on screen. The app asks to disable battery optimisation, keeps a VPN active while running and, in its code, requests permission to send SMS, write contacts, read notifications and draw over other apps. The participant's account and number become bulk-sending infrastructure for third parties, and their internet connection becomes the egress for that traffic. Whoever receives the bait sees the participant's name and number.

The cost falls on whoever installed it. WhatsApp prohibits automated and bulk sending and suspends accounts for it; participants show accounts "under review" days after starting. Ganxora's official Telegram channel treats bans as part of the business: it publishes an account "warm-up" manual, in English and with screenshots from an Indian number, and recommends using multiple SIMs ("the more SIMs, the greater your task capacity", one SIM per account), with photos of batches of prepaid SIM cards. The October partner programme pays per "active", defined as anyone who has withdrawn.

Who pays the withdrawals

The R$ 5 to R$ 100 withdrawals seen in receipts posted by promoters and participants do not come from a Ganxora account. They come from intermediary companies that rotate: CyberX's research identified nine paying entities between 23 September and 10 October 2026, two or three on the same day. According to Receita Federal records, consulted on 11 and 12 October, Mercado Online Sul Ltda (CNPJ 68.833.903/0001-97), Block Pagamentos e Intermediações Ltda (68.801.750/0001-04) and Swapx Tecnologia e Intermediação Ltda (68.769.820/0001-86) were incorporated between 25 and 27 August 2026; J. Caetano Ltda (67.699.898/0001-09), in June 2026; Soluções RA Ltda (69.156.627/0001-32), on 16 September 2026; RFA Multisserviços Conservação e Limpeza e Papelaria Ltda (58.669.916/0001-19), in January 2025; and a single-owner micro-enterprise in Rolim de Moura (RO), registered in November 2025 (63.523.538/0001-09), whose holder we do not name. The declared business activities range from bookselling to textiles and advertising. Two are older intermediaries: Zahav Pag Ltda (35.992.517/0001-99, from 2020) and D7 Soluções On-Line Ltda (14.569.074/0001-58, from 2011). Zahav also paid Movriza withdrawals in July 2026; One XPaymente Ltda (35.967.485/0001-71, now listed as inactive by the Receita) paid them in August. Several of these accounts turn up in public complaints receiving Pix transfers from betting sites and other scams on the same dates. The CNPJs are listed in the identifiers section: if one of them appeared on your receipt, it is the same circuit. The names of the partners are kept off this page.

The kit behind it: Movriza and the per-country brands

Ganxora is the second Brazilian skin of one and the same app. Movriza, promoted in Brazil since June 2026 through the same "side income" channels, uses the same API, the same sign-up bonus scheme, task-after-pairing and referral commission, and Ganxora's own app carries in its code a shortcut pointing to the Movriza API. The digital certificate signing the Ganxora APK is the same one that signs the apps for Banglio (Bangladesh) and PaisaChat (Pakistan); Mile Ai, of Pakistan, is behind the same API. Ganxora's configuration still records the sign-up bonus in Indian rupees, and the same registration contact appears across thirteen domains in the family, ten of them registered in the same minute, one per country. Based on CyberX's research, the kit's vendor is Chinese-speaking and distributes it by country, recruiting regional operators. The Brazilian operator has not been identified.

As of 12 October 2026, ganxora.com, ganxera.com and the API were responding; the @Ganxora Telegram channel had 59 subscribers, and the official group 388 members the previous day. Web searches for the name returned no mentions outside the operator's and promoters' channels. We found no public complaint, police report or action by any authority bearing the name.

What the sources support, and what they do not

They support: that Ganxora distributes, outside the official store, an app that links the user's WhatsApp as a connected device and sends messages from their account; that it pays small withdrawals through intermediary companies that take turns; that the official channel encourages the use of multiple SIMs and treats bans as a cost of doing business; that the app belongs to a kit used in other countries and has Movriza as its sibling brand in Brazil. They do not support: who operates the brand in Brazil, how many people take part, whether charges follow later, or whether the holders of the paying companies know what the accounts are used for. No individual's name appears here.

If you installed it

In WhatsApp, open Settings, then Linked devices, and disconnect any device you do not recognise, especially a "Google Chrome (Mac OS)" entry. Uninstall the Ganxora app and check, in Android settings, whether it remained set as the default SMS app or kept an accessibility service enabled. Turn on WhatsApp's two-step verification and change the passwords of any accounts that receive codes by SMS. Tell your contacts that "reward" messages sent from your number were not you. Do not buy SIM cards to "increase capacity" and do not pay for top-ups, fees or "verification". If your account was suspended, use WhatsApp's own appeal process. Keep screenshots of the app, the tutorial and the receipts; if you paid anything, file a police report and ask your bank for the Mecanismo Especial de Devolução (Pix refund mechanism).