Man narrowly escapes ‘digital arrest’, creates APK files to help cybercriminals steal Rs 150 crore

MUMBAI: A 36-year-old graphic designer who once narrowly escaped a ‘digital arrest’ scam went on to create malicious software that helped cyber fraudsters cheat more than 9,600 people out of Rs 150 crore, police said on Thursday.

Indore resident Pankaj Gupta was arrested by the Property Cell of the Mumbai Crime Branch for allegedly creating and supplying 2,805 malicious Android Package Kit (APK) files to cybercriminal networks operating out of Bihar and Jharkhand, said officials.

“Five years ago, Gupta closely escaped a digital arrest scam. Instead of staying away, he spotted a business opportunity and reached out to fraudsters, offering them custom-built APK files that act as digital ‘remote controls’ to compromise target smartphones,” a senior police officer said.

A malicious APK file is a counterfeit or infected Android application designed to steal sensitive data, intercept OTPs, or take remote control of a mobile device.

Gupta, who knew coding, created APK files disguised as popular government and utility services, including senior citizen card verification, e-traffic challans, pension verification, credit card updates, and PM Kisan Yojana portals, police said.

The breakthrough in the case came after a senior citizen from Mumbai’s Byculla area lodged a complaint on August 13, saying he was conned.

“The victim received a call from an individual posing as a nationalised bank representative offering assistance with a Senior Citizen Card scheme. Upon clicking an APK link sent via text, Rs 5.62 lakh was fraudulently debited from his account,” the official said.

A technical analysis led the Mumbai Crime Branch to Gupta in Indore.

Police said Gupta rented servers from various companies to host the APK data and sold each malicious file to ground-level calling modules for Rs 20,000 to Rs 25,000.

“The cyber rings contacted victims using leaked data from banks and institutions. The syndicate has targeted 9,673 individuals across India, with 1,074 complaints registered on the national cyber portal ‘130’, including 142 in Maharashtra and 36 in Mumbai alone,” the official said

The victims were collectively defrauded of nearly Rs 150 crore with the help of the harmful software created by Gupta.

Further investigation into the network and its ground-level operatives is underway, the official added.