PTC Web Desk:  An 18-year-old Class 11 dropout has been arrested for allegedly creating fake banking and government mobile applications that were used in cyber frauds worth more than Rs 64 crore across India, the Surat police said.

The accused, identified as Rohit Virendrasinh Shakya, was arrested by the Surat City Cyber Crime Cell from a hotel in Kanpur, Uttar Pradesh. Investigators claim he developed malicious Android (APK) files using artificial intelligence and distributed them to cybercriminal groups through Telegram.

Also Read | 'Godzilla vs Kong' actress Kaylee Hottle dies at 18 in tragic car crash in US

According to the police, Shakya became a skilled coder despite leaving school after Class 11. By the age of 16, he had learned advanced coding and started creating fake applications that closely resembled official banking, government and private-sector apps.

The police said he supplied these malware apps to cybercriminals on a monthly subscription model, charging around Rs 15,000 for customised versions along with regular updates.

How the fraud worked

Investigators said the accused designed two different applications for the fraud. The first was a fake app that victims unknowingly installed on their mobile phones. Once installed, the malware secretly gained access to the device.

The second was an admin app, which allowed cybercriminals to remotely view OTPs, banking passwords and other confidential information, enabling them to transfer money from victims' accounts.

The fake apps were designed to look like genuine applications of several well-known organisations, including SBI, Punjab National Bank, Axis Bank, ICICI Bank, Union Bank, UCO Bank, American Express, BigBasket, Aadhaar services, PM Kisan and RTO challan payment portals.

Also Read | Sadak se Sansad tak: From farmers to CJP, a look back at India's biggest Parliament marches that brought revolution

The case came to light after a Surat resident reported losing Rs 5 lakh in May this year. According to the complaint, the victim received a fake PNB One APK through WhatsApp and believed it to be the bank's official application. Soon after installing it, cybercriminals gained access to his phone and transferred Rs 5 lakh from his bank account.

The victim immediately contacted the national cyber helpline (1930), following which Surat Cyber Crime registered an FIR and began an investigation.

Police uncover large-scale cyber network

During the investigation, digital forensic experts found that Shakya had allegedly developed 121 malicious APK applications. These fake apps were installed on 21,672 mobile phones across India. The police said 2,928 devices were completely compromised, leading to 54,094 fraudulent banking transactions worth approximately Rs 64.38 crore.

Among the fake applications, RTO challan apps were reportedly used in the highest number of fraud cases, followed by fake SBI and PNB banking applications.

Also Read | Pathankot-Jalandhar highway accident: Two dead after private bus runs over riders, bus torched by angry crowd

The police said the malicious applications were supplied through Telegram to organised cybercrime gangs operating mainly from Jamtara in Jharkhand, as well as networks in Haryana and Rajasthan. The software was allegedly provided on a paid subscription basis, with regular maintenance and updates for users.

During the arrest, the police seized two mobile phones and a laptop from the accused. Digital forensic experts are examining the devices to gather more evidence.

Investigators are now trying to identify other cybercrime syndicates that may have used the malware and are also looking into the possible involvement of additional suspects in the network.

Authorities have urged people to download mobile applications only from official app stores and avoid installing APK files received through WhatsApp, Telegram or unknown sources.

- With inputs from agencies

Join Whatsapp Channel