99exch Black APK: What It Claims to Be, the Real Risks, and a Safer Way In

Home › 99exch Black APK

By Raja Venu · Reviewed by the 99exch.in desk team · Published 17 October 2026 · Editorial policy · 18+

What a “99exch black APK” claims to be

Search for 99exch on an Android phone and you will soon find download pages offering a “99exch black” APK, sometimes alongside “99exch green” or “99exch pro” versions. The pitch is usually similar: a faster app, a darker theme that is easier on the eyes during night matches, push notifications for odds, or access that “works even when the website is blocked”. Some pages add a bonus code or promise exclusive markets.

An APK is simply the file format Android uses to package and install apps. Files from the Google Play Store are APKs too, but they arrive through a store that checks publishers and scans for malware. An APK downloaded from a web page, a Telegram channel or a WhatsApp forward skips that process entirely. Whoever built it decides what it does once it is on your phone.

We cannot verify who builds the files circulating under the 99exch black name, and we are not aware of any way for an ordinary user to verify it either. Some may be thin wrappers that simply open a panel website inside an app frame. Others have been modified to do much more. From the download page, there is no reliable way to tell which is which.

That uncertainty is the core of our advice. The panel is a responsive website that works in a phone browser without installing anything, so an APK offers very little that you cannot get more safely another way. The rest of this page explains the risks in practical terms, shows you how to check a file if you are determined to, and walks through what to do if you have already installed one. For the browser-based alternative in full, see our 99exch app guide.

Why so many colour-named APKs exist

The same forces that produce colour-named websites also produce colour-named apps. Resellers and affiliates want a product they can brand and distribute, and an app icon sitting on a customer's home screen is a powerful way to keep that customer. A colour is a quick way to make one file sound different from another.

There is also a less innocent reason. An app is an excellent tool for someone who wants to steal from betting users. A fake website can only capture what you type into it. A malicious app, once installed with the right permissions, can read incoming text messages, watch what appears on your screen, display fake login windows over genuine apps, and in some cases operate the phone without your involvement. Those capabilities are exactly what is needed to intercept banking OTPs and drain accounts.

Because betting users are known to move money through UPI and to be comfortable installing apps from links, they are an attractive target. Colour names, bonus codes and promises of unblocked access are bait designed to get the file installed and the permissions granted. This is not a theoretical concern; cyber police units in India regularly publish public warnings about fraudulent APK files shared through messaging apps.

None of this means every colour-named file is malicious. It means you cannot tell from the outside, and the consequences of guessing wrong can reach well beyond your betting ID to your bank account.

Android sideloading, explained plainly

Installing an app from outside the Play Store is called sideloading. Android allows it, but it adds deliberate friction because the operating system knows the file has not been through the store's checks.

On current versions of Android, permission to install unknown apps is granted to a specific source app, such as Chrome, your file manager or WhatsApp. When you tap a downloaded APK for the first time, the phone asks whether you want to allow that source to install apps. Agreeing opens a door that stays open for that source until you close it again in settings.

Google Play Protect, which is built into most Android phones that use Google services, scans apps on the device, including sideloaded ones, and may warn you or block an install it considers harmful. That is useful, but it is not a guarantee. New or lightly modified malicious files can slip past automated scanning for a period, and many people tap through warnings because the download page told them to expect one.

Download pages for betting APKs commonly include instructions such as “ignore the Play Protect warning, it is normal for betting apps” or “turn off Play Protect before installing”. Treat any instruction to disable a security feature as a serious red flag. A legitimate developer has no reason to ask you to switch off your phone's protection.

Permissions a betting app should never need

Every Android app declares the permissions it wants, and the most sensitive ones must be approved by you. A genuine app that only displays a betting panel needs very little: internet access and perhaps notifications. Anything beyond that deserves scrutiny. The table below lists the permissions that should stop an install, and why.

If an APK requests any of these, especially SMS, accessibility, overlay or device administrator access, the safest response is to cancel the install and delete the file. There is no feature of a betting panel that requires them.

How OTP theft and overlay attacks work

It helps to understand, in general terms, how the permissions above are combined, because the attacks are designed to be invisible.

In a typical OTP interception, a malicious app with SMS or notification access quietly forwards every incoming message to whoever controls it. The attacker, who may already have your card or account details from elsewhere, starts a transaction and waits for the OTP your bank sends. Because the app reads it before you do, or at the same moment, the transaction completes. Some apps then delete or hide the message so that you do not notice.

In an overlay attack, the app watches which other app you open. When you launch a banking or UPI app, it instantly draws a convincing fake login screen on top. You enter your PIN or password believing you are in your bank's app, and the details go straight to the attacker. The genuine app is still there underneath, so everything appears normal once the overlay closes.

An app with accessibility access can go further still, reading screen content and performing taps, which in effect lets someone operate parts of your phone remotely. Combined with device administrator rights, such an app can also resist removal.

These techniques are well documented in public security research and in warnings from Indian banks and police. The defence is simple: do not install apps from unverified sources, and never grant these permissions to an app that has no clear need for them.

How to check an APK if you are considering one

Our advice is not to install any 99exch APK. If you are nonetheless considering a file, these checks will at least catch the most obvious problems. None of them can prove a file is safe; they can only reveal that it is not.

1. Ask where it came from. A file forwarded in a group, offered by a stranger, or downloaded from a page you reached through an ad is the riskiest kind. Ask your desk whether they recognise it. A desk that issued your ID can tell you whether they distribute any app at all.
2. Look before you install. When Android shows the install screen, read the list of permissions or tap to see more details. Compare it with the red-flag table above.
3. Leave Play Protect on. If it warns you about the file, take the warning seriously. Do not follow instructions to disable it.
4. Check the publisher. App files are digitally signed by whoever built them. Some file managers and app-information tools can show the signing certificate. An unknown or generic name, or a certificate that differs from a previous version of the same app, is a warning sign.
5. Scan the file. Online multi-engine scanning services let you upload a file and see whether security vendors flag it. A clean result does not prove safety, because new threats may not be detected yet, but any detection is a reason to delete the file.
6. Watch its behaviour. If an installed app asks for new permissions after an update, opens a full-screen request to enable accessibility, or prompts you to make it a device administrator, uninstall it immediately.

Be careful, too, with updates. A file that behaved well when you first installed it can change after an update delivered outside the Play Store. Some malicious apps start harmless, build up a base of users, and only add dangerous behaviour later through an update or a downloaded component. If an app you sideloaded asks to update itself through a link or a pop-up, treat that update as a brand-new install and repeat every check above.

Finally, consider who else uses the phone. If a family member shares the device, or if it holds work email and banking apps for your household, the consequences of a bad install reach beyond you. That alone is a strong reason to keep betting access in the browser, where a website cannot touch the rest of the phone.

Even a file that passes every check can still contain a version of the panel you cannot verify. That is why the browser route described next remains the better option.

The safer alternative: browser plus a home-screen shortcut

Everything a black APK promises, apart from features that should worry you, is available through your phone's browser. The panel is a responsive website, and both Android and iPhone let you place a shortcut to it on your home screen so that it opens with a single tap.

On Android

Open the panel link from your ID chat in Chrome. Tap the menu in the top corner and choose the option to add the page to your home screen or install it. Give the shortcut a clear name and confirm. It will appear alongside your other apps and open the panel full-screen.

On iPhone

Open the panel link in Safari, tap the Share button, and choose “Add to Home Screen”. The icon behaves like an app but is simply a saved web page with no special access to your phone.

A shortcut has no permission to read your messages, draw over other apps or control your device. It can only do what a website in your browser can do. If the panel moves to a new address, delete the old icon and create a new one from the updated link your desk sends. Screenshots of each step are in our 99exch app guide.

Push notifications are the other feature APK pages often promise. In practice, most users find that the live score and odds on the panel itself, combined with a free cricket score app from a reputable publisher, give them everything they need without granting a betting file any access to their phone. Fewer alerts can also make it easier to stick to the limits you set.

The “dark mode” that many black APKs advertise is also available without an app: most browsers and phones offer a system-wide dark theme, and many panels follow it automatically.

iPhone users: “black” profiles and enterprise certificates

Because Apple does not allow sideloading in the same way as Android, people offering a “99exch black” app for iPhone usually rely on other routes. You may be asked to install a configuration profile, trust an enterprise developer certificate, or use a third-party installer.

Each of these asks you to give an unknown party a level of trust that Apple normally reserves for employers and organisations managing their own devices. A configuration profile can, depending on its contents, route your internet traffic through someone else's servers, install certificates that let them read encrypted connections, or change device settings. Apps signed with misused enterprise certificates bypass App Store review entirely.

If a page asks you to go to Settings and trust a developer or install a profile in order to get a betting app, decline. If you have already done so, open Settings, look under General for VPN and device management, and remove any profile you do not recognise. Then follow the clean-up steps in the next section. On iPhone, the Safari home-screen shortcut gives you the same convenience with none of the risk.

If you have already installed a 99exch black APK

Do not panic, but do act promptly. Work through these steps in order.

1. Disconnect if anything looks wrong. If you see unexpected SMS activity, payment alerts you do not recognise, or the phone behaving oddly, turn on airplane mode while you work through the next steps.
2. Check device administrator apps. In Settings, search for “device admin” and remove admin rights from the app if it has them. Until you do, Android may not let you uninstall it.
3. Remove accessibility and overlay access. In accessibility settings, turn off any service belonging to the app. In special app access, remove its permission to display over other apps.
4. Uninstall the app. Go to Settings, then Apps, find it, and uninstall. If the uninstall button is greyed out, revisit step two.
5. Revoke unknown-source permission. In special app access, under install unknown apps, switch off the permission for the browser, file manager or messaging app you used to install it.
6. Run a Play Protect scan. Open the Play Store, go to Play Protect and scan the device.
7. Secure your accounts from a clean device if possible. Change your betting ID password through your desk, your email password, and any banking or UPI PINs you entered while the app was installed. Check your bank and UPI transaction history.
8. Report fraud quickly. If money has left any account, call the national cyber fraud helpline 1930 immediately and file a complaint at cybercrime.gov.in. Inform your bank as well.

Tell your desk what happened, too. A desk that knows your phone may have been compromised can watch for unusual requests on your ID, such as a sudden change of payout details, and can verify them more carefully until you confirm the device is clean. Keep a note of the app name, where you downloaded it and the dates it was installed, as these details help if you need to file a report.

If the app had device administrator and accessibility access for a long time, or you are unsure whether it has been fully removed, backing up your photos and documents and performing a factory reset is the most thorough option. Our password reset guide explains how to get a new ID password from your desk.

“Works when the website is blocked”: what that claim really means

One of the most common selling points on black APK download pages is that the app keeps working when the panel's website is unreachable. It is worth understanding what is going on behind that promise, because it explains a lot about how these files behave.

When a website cannot be reached on your network, the usual reasons are that the address has been retired, that your mobile operator or Wi-Fi provider is blocking it, or that it has been flagged as harmful. An app that claims to get around this typically does one of a few things. It may contain a built-in list of alternative addresses and switch between them. It may route its traffic through its own servers, acting as a kind of proxy. Or it may bundle a VPN-style component that sends some or all of your phone's internet traffic through infrastructure controlled by whoever built the app.

Each of those approaches puts a third party between you and the panel. If the app routes your traffic through its own servers, those servers can see and potentially alter what passes through them, including your login details if the connection is not properly protected end to end. If it installs a VPN component, it may be handling far more than your betting traffic. And because you cannot verify who runs that infrastructure, you are extending a great deal of trust to a stranger.

There is also a simpler point. If a genuine panel address has stopped working for you, the straightforward fix is to ask your desk for the current link, which costs nothing and introduces no new risk. An app that offers to solve the problem for you by quietly re-routing your connection is solving it in the way that suits its builder, not necessarily in the way that protects you.

A phone security checklist for anyone who uses UPI and betting panels

Whether or not you ever install an APK, the phone you use for betting is usually the same phone you use for banking. A few settings and habits greatly reduce the chance that a mistake on one side spills over into the other.

• Keep Android or iOS updated. Security updates close holes that malicious apps rely on. If your phone no longer receives updates, be especially careful about what you install.
• Use a strong screen lock. A PIN of six digits or more, or biometric unlock backed by a PIN, prevents anyone who picks up your phone from opening your banking or betting apps.
• Turn on two-step verification for WhatsApp. Your ID, panel link and desk conversation all live in that chat. A WhatsApp PIN makes it much harder for someone to take over your account on a new phone.
• Review special app access every few months. In settings, check which apps can display over other apps, use accessibility services, act as device administrators or install unknown apps. Remove anything you do not recognise or no longer use.
• Set UPI and bank limits. Most UPI apps and banks let you set daily transaction limits. A lower limit caps the damage if something goes wrong.
• Never share a screen with a stranger. Screen-sharing apps are another route to OTP theft. No genuine desk or bank needs to see your screen.
• Read every OTP message. Bank OTPs state what they are for. If one arrives for a transaction you did not start, do not share it with anyone and contact your bank.

These habits cost nothing and take minutes. They protect your money far more effectively than any feature an unofficial app could offer.

What this desk does and does not send you

To make your decisions easier, here is exactly what you can expect from 99exch.in in relation to apps and links.

• We send your username, a temporary password and the current panel link in your WhatsApp chat. That link opens in your browser.
• We do not send APK files, and we do not ask you to install any app to use your ID.
• We never ask you to disable Play Protect, trust a developer certificate or install a profile.
• We never ask for an OTP, UPI PIN, transaction password, your current login password or any fee.
• If a message claiming to be from us contains an APK or asks for any of the above, it is not from us. Confirm in your original chat and report it.

Deposits start at ₹500 by UPI or NetBanking and ₹1,000 by bank transfer, and ordinary daytime withdrawals typically arrive in 15–30 minutes. None of that requires an app. If you would like to explore the panel first, a demo ID uses virtual points and costs nothing. Our real or fake checklist covers the wider warning signs of fake agents.

The legal position in India

The Promotion and Regulation of Online Gaming Act, 2025 and the Online Gaming Rules, 2026 have been in force since 1 May 2026. The Act prohibits online money games across India, including online betting, and treats offering, advertising and facilitating payments for them as offences. State laws continue to apply alongside it.

We are not lawyers and nothing here is legal advice. If Indian law applies to you, assume that taking part may be unlawful and seek independent advice. Be aware too that apps promising to “work when the website is blocked” are, by design, trying to get around restrictions, which carries its own legal and security risks. Read the legal section of our main guide for a fuller summary.

18+ only: playing responsibly

This site is for adults aged 18 and over. Betting carries real financial risk, and an app icon one tap away can make it easier to play more often than you intended. Set a budget before you start, keep stakes small and never chase losses.

Our desk can apply a deposit cap, a time-out from 24 hours to six weeks, or a longer self-exclusion, and can close an ID permanently on request. If gambling is affecting your wellbeing, free and confidential help is available from Tele-MANAS on 14416. Our responsible gaming page explains each limit and lists further support. For anything else, the channels on our contact page are the only ones we use.

Frequently asked questions

What is the 99exch black APK?

It is an Android app file circulated under the 99exch black name by download pages and resellers. We cannot verify who builds these files or what they contain. The panel itself works in any phone browser, so no APK is needed to use a 99exch ID.

Is there an official 99exch app on the Play Store?

We cannot verify any official 99exch app on the Google Play Store or Apple App Store. Most users open the panel link from their ID chat in a browser and add it to the home screen, which gives app-like access without installing anything.

Is it safe to download a 99exch APK?

We advise against it. An APK from a web page or a forwarded message skips store checks, and a modified file can read SMS OTPs, show fake login screens over banking apps or resist removal. The browser shortcut gives the same convenience without those risks.

Which permissions should a 99exch app never ask for?

A betting app has no need to read SMS, use accessibility services, display over other apps, become a device administrator, read contacts or call logs, access all notifications or install other apps. A request for any of these is a reason to cancel the install.

Why does the APK page tell me to turn off Play Protect?

Instructions to disable Play Protect or ignore its warnings are a serious red flag. A legitimate developer has no reason to ask you to switch off your phone's security. Leave Play Protect on and do not install a file that it warns you about.

Can I get 99exch black on iPhone?

Offers of a 99exch black app for iPhone usually ask you to install a configuration profile or trust an enterprise certificate. Both give an unknown party significant control over your device. Decline, and use a Safari Add to Home Screen shortcut instead.

I already installed a 99exch black APK. What should I do?

Remove any device administrator, accessibility and overlay access the app has, uninstall it, revoke unknown-source permission and run a Play Protect scan. Then change your ID, email and banking passwords, check your transactions, and call 1930 if money is missing.

Does a black APK work when the 99exch website is blocked?

Apps making this claim usually switch between hidden addresses or route your traffic through their own servers, which puts an unknown third party between you and the panel. If your link has stopped working, ask your desk for the current one instead.

Does 99exch.in send APK files?

No. This desk sends your username, a temporary password and the current panel link, which opens in a browser. We never send APKs, never ask you to disable security features, and never ask for an OTP, UPI PIN, password or fee.

Related 99exch guides

• 99exch app and home-screen guide
• 99exch green login safety
• 99exch red address guide
• is 99exch real or fake?
• reset a 99exch password
• 99exch login help