After digital arrest, man joins con in Mumbai; creates mobile 'remote control' to steal ₹150 crore

Pankaj Gupta, a graphic designer from Indore, is now in police custody in Mumbai.

Pankaj Gupta, 36, narrowly escaped a digital arrest scam. But unlike others who managed to evade the fraudsters, Gupta spotted an opportunity. He got in touch with scamsters and decided to throw in his lot with them.

Gupta, a graphic designer from Indore, is now in police custody in Mumbai, after being arrested for creating and supplying 2,805 APK files used by cyber criminals to wipe out ₹150 crore from the bank accounts of unsuspecting victims, often senior citizens. (Pexels/Representational)

Gupta created Android Package Kits (APK – with the .apk extension), which steal data from smartphones – a digital remote control, of sorts. Then he would click on suspicious links or Chinese loan applications and use them to pitch his ‘business idea’ to the fraudsters. He even offered trials of his APK files, said a police officer.

How the APK files were used

That was five years ago. Gupta, a graphic designer from Indore, is now in police custody in Mumbai, after being arrested for creating and supplying 2,805 APK files used by cyber criminals to wipe out ₹150 crore from the bank accounts of unsuspecting victims, often senior citizens.

The criminals would then make calls to potential victims on the pretext of a pending e-challan or something similar, and send the APK files to their phones. Once the victim clicked on the file, it would steal private information from the phone and grant the cybercriminals access to OTPs, which the fraudsters used to empty their victims’ bank accounts.

Gupta created Android Package Kits (APK – with the .apk extension), which steal data from smartphones – a digital remote control, of sorts

The complaint that led to Gupta’s arrest

On August 13, a complaint from a senior citizen swindled of his life savings put an end to Gupta’s illegal ‘APK file’ enterprise. “A senior citizen from Byculla got a call from a person claiming to be calling from a nationalised bank, where he had an account. They told him they were helping their elderly customers make a Senior Citizen Card that would help them avail benefits under various government schemes. They sent him a link asking him to fill in his details. As soon as he clicked on the link, an APK file, the senior received a message that ₹5.62 lakh had been debited from his bank accounts,” said a police officer.

The Byculla police registered a case of cheating and impersonation but the offence was simultaneously investigated by the Property Cell of the Mumbai Crime Branch. “While examining the technical details, we were led to Pankaj Gupta in Indore,” said a police officer.

Investigation reveals the scale of the operation

“He was a big player as he had stored the data of the APK files that he made in several servers,” said the police officer. Gupta would pay various companies to rent their servers. He then started getting in touch with groups of cyber criminals and offered to sell his APK files to them. He allegedly sold them to cyber fraudsters in Bihar and Jharkhand for ₹20,000-25,000 per file.

“The accused made calls to victims after illegally getting leaked data from banks and other institutions. The data we accessed revealed that the accused has so far cheated 9,673 people. Around 1,074 complaints are lodged against them via the cyber helpline, 142 in Maharashtra, 36 in Mumbai alone,” said the police officer.

The police said the gang working with Gupta had cheated people to the tune of ₹150 crore. This included purchasers of the APK files, persons who made fraudulent calls, procured SIM cards and bank accounts to perpetrate the fraud.

Experts warn about malicious APK files

“Android is a widely used mobile operating system, especially in India. While its open-source nature allows easy customisation and access to multiple apps, it also opens a window for cyber attacks. Cyber criminals may deploy malicious APK files that pose a threat to the security of your data,” said a police officer.

“Developers like Gupta are backend tech providers,” says cyber security expert Neehar Pathare. “They create custom templates and embed remote access Trojans (RATs) into them. They sell or lease these functional APKs to ground-level extortion rings, says Pathare, MD, CEO & CIO, 63SATS Cybertech.

“Now that AI tools are freely available, malicious APKs don’t look the way they did before. Cyber criminals use clean user interfaces with official logos and flawless text that look exactly like actual corporate apps, so it’s hard for people to tell the difference,” he adds.