Cybersecurity

India’s Indian Cyber Crime Coordination Centre (I4C) held S4C Connect, a workshop on cryptocurrency and darkweb crime, in New Delhi on 8 October 2026. Union Home Secretary Govind Mohan, I4C CEO Rajesh Kumar, state and UT cybercrime chiefs and industry experts attended. The aim was to tighten coordination between the Centre and states as crypto laundering and darkweb markets drive more fraud.

Japan’s JPCERT/CC has warned of a run of intrusions around September 2026 that leaked large volumes of personal data from Japanese organisations. Attackers scanned for known flaws, reverse-engineered mobile apps to find hidden API endpoints and keys, abused internal admin APIs and NoSQL injection, and exploited the Metabase SQL injection flaw CVE-2026-72898. Internal BI tools and staff systems were also hit.

Mumbai Crime Branch has arrested a 36-year-old Madhya Pradesh software developer accused of building and selling 2,805 malicious Android APKs to fraud gangs. Police link the apps to 9,673 victims nationwide and about ₹150 crore in fraud. The case shows how ready-made malware is sold as a service outside Google Play.

Pakistan’s National Cyber Crime Investigation Agency says its Multan unit has arrested two men allegedly involved in registering and using multiple fake SIM cards linked to financial scams. Officers recovered two mobile phones. The case fits a wider pattern of “mule SIMs” used to hide the real callers behind fraud.

India’s Indian Cyber Crime Coordination Centre (I4C) has warned that fake AI trading ads on social media are being used to hijack Instagram accounts. Victims are asked to fill in a sign-up form and enter a “verification code” that is actually their Instagram login code. Citing Meta, I4C said 16,000 such cases surfaced in one month.

Police in Sitapur, Uttar Pradesh, have arrested a man accused of misusing a point-of-sale agent ID and people’s biometrics to activate SIM cards in their names and sell them on. Officers seized 25 SIM cards, five phones and a motorcycle. Such “mule SIMs” hide the real user and are widely used in cyber fraud.

India’s UP Police have arrested two people and placed one juvenile under watch in an alleged online gaming and betting fraud that used fake social media ads, WhatsApp and WATI groups, and sites including Mahadev Game, Lotus Game, MY99 and MY REDDY 99. Officers seized ₹15 lakh in cash and digital evidence of crores in transactions.

NCCIA Lahore detained more than three dozen people in raids on alleged illegal call centres in Faisal Town and Johar Town, the agency said on 4 October 2026. The lineup photo shows 38 people besides three officers. The centres allegedly targeted people abroad with fake mobile upgrades and network packages, using dial-up software.

Wathoda police arrested Antariksh Mishra, 19, and Amit Patil, 23, after a 27-year-old hospital technician was allegedly lured through a gay dating app to an isolated spot near Bahadura Phata, threatened with a knife and robbed at an ATM, Lokmat Samachar reported on 4 October 2026. The case is a dating-app contact that moved offline into extortion.

India has demonstrated its first free-space quantum key distribution link, 5.56 km between BISAG-N and IIT Gandhinagar, PIB said on 3 October 2026. QNu Labs’ Armos system held the error rate under 5 percent and produced keys at 230–260 bits per second, which BISAG-N’s Vedic Kavach platform used to encrypt and decrypt test messages.

INTERPOL's Industrialization of Cybercrime report uses FUD once, as Fully Undetectable: crypter, packer, and anti-detection services sold so malware looks clean to antivirus and endpoint tools. Vendors re-wrap files, test them until scanners report them clean, and sell that result per test or by monthly subscription, often with proxies, VPNs, and anti-detect browsers. The report gives no FUD price, volume, or named product.

Threat analysis of a Google Sites phishing kit reported by @VincentBounce: spoofed Google ‘app password / security alert’ mail, landing on sites.google.com/view/delete-new-app with CAPTCHA theatre, credential forms that trigger password-manager autofill, and mailed-by fwd.privateemail.com instead of Google bounce hosts. Includes IOCs and defender checklist.