Digital Deception on the Frontier: Decoding the SSB Advisory on Honey Traps, Malicious APKs and Cyber Fraud
Introduction
On 14 October 2026, ANI reported that the Sashastra Seema Bal (SSB), the force responsible for guarding India’s borders with Nepal and Bhutan, had directed its personnel not to fall for online honey traps, open suspicious APK files, or become victims of cyber scams. The warning was issued a day after the force’s annual cybersecurity awareness week and is relevant to every smartphone user in India. The three threats highlighted in the advisory, emotional exploitation, malware disguised as APK files, and financial scams, are often interconnected in a cyberattack chain that can compromise a person’s device or finances. This blog examines the advisory, the methods used by cybercriminals, and the everyday precautions users can take to stay safe.
What the Advisory Says
As per the ANI report, the SSB has cautioned its personnel about talking to strangers on the internet, where they have been instructed not to share photos or videos with anyone in the public eye, accept suspicious calls or video calls, or entertain requests for money, and not to install APKs or applications from any untrusted sources or websites, only use an authorised Android market to install applications, not to share your OTP, PIN, password, or banking details, and to be cautious while receiving an unknown call, suspicious SMS, or click on unknown links and scan QR codes. Personnel have been told not to tell something that does not seem right, and any fraud should be reported through cybercrime helpline number 1930 or cybercrime.gov.in. "Always verify before any transaction" & "Stop, think, check, then act." The SSB caution has been read.
How Online Honey Traps Operate
A honey trap, by definition, is a trap set through the manipulation of a fictitious romantic or social identity designed to gain trust, which is then used against it. There are certain elements that almost always constitute the honey trap.
- Contact: A fake profile, typically an attractive picture, reaches out to the targeted person on social media or a messaging platform.
- Rapport: Created via a mix of small talk, flattery, and "shares" or "interests."
- Escalation: The chatting advances to private messaging, involving sharing of photos or video.
- Extortion: The victim is subsequently threatened with blackmail through recordings, forced to make payments, or extorted for personal information.
This is not an isolated case. Earlier, the Delhi Police had revealed that fake Facebook female profiles were used to lure and befriend defence personnel and extract confidential information (The Quint). Even more recently, a case was reported of an IAF wing commander being lured on social media while undergoing troubled times and, thereafter, made to reveal sensitive defence-related information (Outlook India). While the matter is sub judice, it draws our attention towards an important point of analytical significance – most probably it is emotional trauma, which an attacker would rely upon, rather than technical and security flaws.
The Risk of Malicious APK Files
APK – Android Package Kit, is the package file format used by the Android operating system for the distribution and installation of mobile applications. Downloaded from Play Store, the application goes through a rigorous screening. However, those downloaded from WhatsApp, Telegram or SMS have not been screened. This is the modus operandi of the cybercriminals. They hide malware behind seemingly harmless files like a challan, a gas bill update, a KYC or a wedding invite. Proof from Moneylife pointing to an alert issued by CERT-In as well as file names like RTO Challan.apk and Gas Bill Update.apk establishes that government departments would not send an APK file over any messaging platform.
According to the CERT-In research of India's cybersecurity agency, the way this malware works: The malware Drinik posed as a download application from the Income Tax Department and asked for a long list of admin permissions, including SMS, call history, and contacts. It then presented a fake banking app to steal credentials, as Madhyamam reports. The Tribune reported that the SOVA trojan was hidden in fake apps with famous brands' logos. The report also states that the Black Rock malware variant was targeting 337 applications, including social, communication, and dating applications.
A security advisory by the bank, dated 24 November 2023, mentions what happens if a virus-infected app is installed. Once installed, the attackers would be able to access the messages with the one-time passwords (OTPs) and personal identification numbers (PINs). They could take over the device and make money transactions from the bank account of the owner of the device, says the advisory.
Social Engineering: The Common Thread
Although honey traps and APK frauds may appear on the surface to be very different, there is one aspect they have in common: both are social engineering tricks. The attacker does not rely solely on technological control or access control but also on human vulnerabilities – the fear, intimidation, lust, or love – to persuade the target to behave in a certain manner. The "opposite" sex may ask you to install some "video call app", or a "bank officer" may advise you to update KYC via a file that you may or may not be having. In any of these instances, it is the final step that you will likely carry out without hesitation. The SSB's four steps (stop, think, check, then act) provide a mechanism to break this cycle.
Implications for Personal, Financial and National Security
A phone on the compromised list reveals contacts, snaps, messages and location. Honey trap nudity can take a toll on a person's mental health and reputation via sextortion.
Financial security- Since malware can read SMS, OTP-based protection works quietly. The fraudster can authorise the transaction without the victim providing a code.
National security – For service members, it's not just their personal information at risk. A compromised device can disclose information about their location and their colleagues or how they operate. Border forces operate in a high-risk environment, and no information is too small; even duty rosters or images taken against a landmark background could be of interest to a hostile person, and honey trap recruitment for spy work is one of the oldest.
Practical Precautions
- Avoid sideloading APKs at all costs. Sideloading APKs is highly discouraged. It is best to keep the "Install from unknown sources" option turned off and install apps only from the Google Play Store or the Apple App Store.
- Whenever you have an unsolicited contact, it is not worth believing. It is believed that reversing the search of profile images and being very careful with new acquaintances who quickly begin chatting in private is protective. Never comply with any requests for money.
- Sharing intimate images or receiving surprise video calls from unknown people should be avoided.
- Storing credentials is especially sensitive. Research has shown that a legitimate bank or government body would not typically ask for details like OTPs, PINs or passwords.
- Scrutinise app permissions. Beware of a seemingly simple app requesting permission to access SMS, call logs or contacts.
- It should be verified from an official source. Challans, KYC or taxes are to be submitted using the official website or app and not the link provided in the message.
- It is important to keep professional and personal lives separate. Do not discuss comments, movements or chores or post location-tagged updates.
- Keeping your devices updated and turning on Google Play Protect are crucial.
- In case you are a victim, do take quick actions. Remove the suspicious app, disconnect from the web, and inform your bank. You can report to 1930 or cybercrime.gov.in. Do not pass the suspicious file as it is going to pass on the same.
Conclusion
The SSB advisory today is a reminder that cyberattacks are less about technology and more about exploiting human vulnerabilities. Studies indicate that fake ID cards, realistic files and misinformation are easy to implement and hard to detect. It appears that cultivating verification routines, instilling a "careful hygiene of use", and quick reporting on 1930 or cybercrime.gov.in are the best initiatives that border forces and citizens can take. Creating awareness about pausing, analysing, verifying and acting if in doubt could be an even better way of building resilience. It is crucial for everyone to remain cognisant and alert and keep cyber safety at the top of the mind.
Related Blogs
.webp)
The concept of web accessibility (i.e., access to the internet) stems from the recognition of internet access as an inalienable right. In 2016, the United Nations Human Rights Commission (UNHRC) General Assembly referred to the access to Internet as an essential human right. The Supreme Court of India also declared such internet access as a fundamental right under the Constitution of India. Various international instruments of which India is a signatory, such as the United Nations Convention on Rights of Persons with Disabilities (UNCRPD) mandate access to information. The heavy reliance on the internet and websites necessitates making the web space inclusive, navigational and accessible to all individuals, including persons with disabilities.
Various laws mandate web accessibility:
- Right of Persons with Disability Act, 2016: The Right of Persons with Disability Act 2016 Is the primary document for the protection of the rights of persons with disabilities to ensure their full participation. The Act provides several direct and indirect provisions (such as Section 2(y) “Reasonable Accommodation”, Section 40 on “Accessibility”, and Section 42 on “Access to Information and Communication Technology”) to ensure that technology products and services are accessible to a person with disabilities.
- Rights of Persons with Disabilities Rules 2017: The 2017 rules under Rule 15 (2) task the respective Ministries and Departments to ensure compliance with accessibility standards.
- Guidelines for Indian Government Websites (GIGW): The GIGW provide a framework for websites to be designed in accordance with Web Content Accessibility Guidelines (WCAG) 2.0 standards. The GIGW enables websites to obtain certification by the Standardisation Testing and Quality Certification Directorate, after audit.
Various other policies include;
- National Policy on Universal Electronic Accessibility, 2013: The National Policy ("Policy") on Electronic Accessibility recognizes the need to eliminate discrimination on the basis of disabilities and to facilitate equal access to Electronics & ICTs. The National Policy also recognizes the diversity of differently-abled persons and provides for their specific needs. The Policy covers accessibility requirements in the area of Electronics & ICT by different stakeholders. It recognizes the need to ensure that accessibility standards, guidelines and universal design concepts are adopted and adhered to.
- Web Content Accessibility Guidelines (WCAG): The WCAG defines how to make web content more accessible to persons with disabilities. While adhering to these guidelines is optional, various versions of the WCAG have been issued. It operates on four principles; perceivable, operable, understandable and robust. It provides a path to ensuring compliance and demonstrating reasonable accommodation for persons with disabilities.
However, despite the laws, web accessibility remains a challenge. A vast majority of Indian websites, especially e-commerce entities and several government websites remain inaccessible to persons with disabilities and most often do not conform with international accessibility standards. A report by the Centre of Internet and Society states that out of the 7800 websites of the Government of India, 5815 had accessibility barriers and 1985 websites failed to open. The report also notes that more than half of the websites had no navigation markup and only 52 websites had the option to change colours. The Ministry of Electronics and Information Technology (MeITy), during the 258th Session of the Rajya Sabha on 9 December 2022 noted that 95 websites of the Central Government have been made accessible to persons with disabilities during the COVID-19 pandemic, however, only 45 websites of the Central Government have been certified as compliant under the Guidelines for Indian Government Websites (GIGW). As of that date, certification of the remaining governmental websites remains incomplete due to the pandemic. Meity also stated that the Department of Empowerment of Persons with Disabilities in 2017 sanctioned a project to be implemented by ERNET India for making 917 websites of State and Union territories. Under the project, a total of 647 websites have been made accessible as of that date.
Conclusion
While India has established a robust legal framework and policies emphasizing the importance of web accessibility as a fundamental right, the existing gap between legislation and effective implementation poses a significant challenge. The reported accessibility barriers on numerous government and e-commerce websites indicate a pressing need for heightened efforts in enforcing and enhancing accessibility standards.
In addressing these challenges, continued collaboration between government agencies, private entities and advocacy groups can play a crucial role. Ongoing monitoring, regular audits and public awareness campaigns may contribute to improving accessibility for persons with disabilities to ensure an inclusive environment and compliance with fundamental laws.
References:
- https://www.legalserviceindia.com/legal/article-2967-right-to-internet-and-fundamental-rights.html
- https://www.indiacode.nic.in/bitstream/123456789/15939/1/the_rights_of_persons_with_disabilities_act%2C_2016.pdf
- https://www.meity.gov.in/writereaddata/files/National%20Policy%20on%20Universal%20Electronics%281%29_0.pdf
- https://www.meity.gov.in/writereaddata/files/National%20Policy%20on%20Universal%20Electronics%281%29_0.pdf
- https://www.w3.org/TR/WCAG21/#:~:text=Web%20Content%20Accessibility%20Guidelines%20(WCAG)%202.1%20defines%20how%20to%20make,%2C%20learning%2C%20and%20neurological%20disabilities.
- https://www.boia.org/blog/india-digital-accessibility-laws-an-overview
- https://cis-india.org/accessibility/accessibility-of-govt-websites.pdf/view
- https://sansad.in/rs/questions/questions-and-answers
.webp)
Introduction:
The Federal Bureau of Investigation (FBI) focuses on threats and is an intelligence-driven agency with both law enforcement and intelligence responsibilities. The FBI has the power and duty to look into certain offences that are entrusted to it and to offer other law enforcement agencies cooperation services including fingerprint identification, lab tests, and training. In order to support its own investigations as well as those of its collaborators and to better comprehend and address the security dangers facing the United States, the FBI also gathers, disseminates, and analyzes intelligence.
The FBI’s Internet Crime Complaint Center (IC3) Functions combating cybercrime:
- Collection: Internet crime victims can report incidents and notify the relevant authorities of potential illicit Internet behavior using the IC3. Law enforcement frequently advises and directs victims to use www.ic3.gov to submit a complaint.
- Analysis: To find new dangers and trends, the IC3 examines and examines data that users submit via its website.
- Public Awareness: The website posts public service announcements, business alerts, and other publications outlining specific frauds. Helps to raise awareness and make people become aware of Internet crimes and how to stay protected.
- Referrals: The IC3 compiles relevant complaints to create referrals, which are sent to national, international, local, and state law enforcement agencies for possible investigation. If law enforcement conducts an investigation and finds evidence of a crime, the offender may face legal repercussions.
Alarming increase in cyber crime cases:
In the recently released 2022 Internet Crime Report by the FBI's Internet Crime Complaint Center (IC3), the statistics paint a concerning picture of cybercrime in the United States. FBI’s Internet Crime Complaint Center (IC3) received 39,416 cases of extortion in 2022. The number of cases in 2021 stood at 39,360.
FBI officials emphasize the growing scope and sophistication of cyber-enabled crimes, which come from around the world. They highlight the importance of reporting incidents to IC3 and stress the role of law enforcement and private-sector partnerships.
About Internet Crime Complaint Center IC3:
IC3 was established in May 2000 by the FBI to receive complaints related to internet crimes.
It has received over 7.3 million complaints since its inception, averaging around 651,800 complaints per year over the last five years. IC3's mission is to provide the public with a reliable reporting mechanism for suspected cyber-enabled criminal activity and to collaborate with law enforcement and industry partners.
The FBI encourages the public to regularly review consumer and industry alerts published by IC3. An victim of an internet crime are urged to submit a complaint to IC3, and can also file a complaint on behalf of another person. These statistics underscore the ever-evolving and expanding threat of cybercrime and the importance of vigilance and reporting to combat this growing challenge.
What is sextortion?
The use or threatened use of a sexual image or video of another person without that person’s consent, derived from online encounters or social media websites or applications, primarily to extort money from that person or asking for sexual favours and giving warning to distribute that picture or video to that person’s friends, acquaintances, spouse, partner, or co-workers or in public domain.
Sextortion is an online crime that can be understood as, when an bad actor coerces a young person into creating or sharing a sexual image or video of themselves and then uses it to get something from such young person, such as other sexual images, money, or even sexual favours. Reports highlights that more and more kids are being blackmailed in this way. Sextortion can also happen to adults. Sextortion can also take place by taking your pictures from social media account and converting those pictures into sexually explicit content by morphing such images or creating deepfake by miusing deepfake technologies.
Sextortion in the age of AI and advanced technologies:
AI and deep fake technology make sextortion even more dangerous and pernicious. A perpetrator can now produce a high-quality deep fake that convincingly shows a victim engaged in explicit acts — even if the person has not done any such thing.
Legal Measures available in cases of sextortion:
In India, cybersecurity is governed primarily by the Indian Penal Code (IPC) and the Information Technology Act, 2000 (IT Act). Addressing cyber crimes such as hacking, identity theft, and the publication of obscene material online, sextortion and other cyber crimes. The IT Act covers various aspects of electronic governance and e-commerce, with providing provisions for defining such offences and providing punishment for such offences.
Recently Digital Personal Data Protection Act, 2023 has been enacted by the Indian Government to protect the digital personal data of the Individuals. These laws collectively establish the legal framework for cybersecurity and cybercrime prevention in India. Victims are urged to report the crime to local law enforcement and its cybercrime divisions. Law enforcement will investigate sextortion cases reports and will undertake appropriate legal action.
How to stay protected from evolving cases of sextortion: Best Practices:
- Report the Crime to law enforcement agency and social media platform or Internet service provider.
- Enable Two-step verification as an extra layer of protection.
- Keep your laptop Webcams covered when not in use.
- Stay protected from malware and phishing Attacks.
- Protect your personal information on your social media account, and also monitor your social media accounts in order to identify any suspicious activity. You can also set and review privacy settings of your social media accounts.
Conclusion:
Sextortion cases has been increased in recent time. Knowing the risk, being aware of rules and regulations, and by following best practices will help in preventing such crime and help you to stay safe and also avoid the chance of being victimized. It is important to spreading awareness about such growing cyber crimes and empowering the people to report it and it is also significant to provide support to victims. Let’s all unite in order to fight against such cyber crimes and also to make life a safer place on the internet or digital space.
References:
- https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3ElderFraudReport.pdf
- https://octillolaw.com/insights/fbi-ic3-releases-2022-internet-crime-report/
- https://www.iafci.org/app_themes/docs/Federal%20Agency/2022_IC3Report.pdf
Recent Incidents:
Recent reports are revealing a significant security threat linked to a new infostealer based malware campaign known to solely target gaming accounts. This attack has affected users of Activision and other gaming websites. The sophisticated software has captured millions of login credentials, notably from the cheats and players. The officials at Activision Blizzard, an American video game holding company, are still investigating the matter and collaborating with cheated developers to minimize the impact and inform the accounts’ residents of appropriate safety measures.
Overview:
Infostealer, also known as information stealer, is a type of malware designed in the form of a Trojan virus for stealing private data from the infected system. It can have a variety of incarnations and collect user data of various types such as browser history, passwords, credit card numbers, and login details and credentials to social media, gaming platforms, bank accounts, and other websites. Bad actors use the log obtained as a result of the collection of personal records to access the victim’s financial accounts, appropriate the victim’s online identity, and perform fraudulent actions on behalf of the victim.
Modus Operandi:
- Infostealer is a malicious program created to illegally obtain people's login details, like usernames and passwords. Its goal is to enable cyberattacks, sell on dark web markets, or pursue malicious aims.
- This malware targets both personal devices and corporate systems. It spreads through methods like phishing emails, harmful websites, and infected public sites.
- Once inside a device, Infostealer secretly gathers sensitive data like passwords, account details, and personal information. It's designed to infiltrate systems being undetected. The stolen credentials are compiled into datalogs. These logs are then sold illegally on dark web marketplaces for profit.
Analysis:
Basic properties:
- MD5: 06f53d457c530635b34aef0f04c59c7d
- SHA-1: 7e30c3aee2e4398ddd860d962e787e1261be38fb
- SHA-256: aeecc65ac8f0f6e10e95a898b60b43bf6ba9e2c0f92161956b1725d68482721d
- Vhash: 145076655d155515755az4e?z4
- Authentihash: 65b5ecd5bca01a9a4bf60ea4b88727e9e0c16b502221d5565ae8113f9ad2f878
- Imphash: f4a69846ab44cc1bedeea23e3b680256
- Rich PE header hash: ba3da6e3c461234831bf6d4a6d8c8bff
- SSDEEP: 6144:YcdXHqXTdlR/YXA6eV3E9MsnhMuO7ZStApGJiZcX8aVEKn3js7/FQAMyzSzdyBk8:YIKXd/UgGXS5U+SzdjTnE3V
- TLSH:T1E1B4CF8E679653EAC472823DCC232595E364FB009267875AC25702D3EFBB3D56C29F90
- File type: Win32 DLL executable windows win32 pepe dll
- Magic: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
- File size: 483.50 KB (495104 bytes)
Additional Hash Files:
- 160389696ed7f37f164f1947eda00830
- 229a758e232aeb49196c862655797e12
- 23e4ac5e7db3d5a898ea32d27e8b7661
- 3440cced6ec7ab38c6892a17fd368cf8
- 36d7da7306241979b17ca14a6c060b92
- 38d2264ff74123f3113f8617fabc49f6
- 3c5c693ba9b161fa1c1c67390ff22c96
- 3e0fe537124e6154233aec156652a675
- 4571090142554923f9a248cb9716a1ae
- 4e63f63074eb85e722b7795ec78aeaa3
- 63dd2d927adce034879b114d209b23de
- 642aa70b188eb7e76273130246419f1d
- 6ab9c636fb721e00b00098b476c49d19
- 71b4de8b5a1c5a973d8c23a20469d4ec
- 736ce04f4c8f92bda327c69bb55ed2fc
- 7acfddc5dfd745cc310e6919513a4158
- 7d96d4b8548693077f79bc18b0f9ef21
- 8737c4dc92bd72805b8eaf9f0ddcc696
- 9b9ff0d65523923a70acc5b24de1921f
- 9f7c1fffd565cb475bbe963aafab77ff
Indicators of Compromise:
- Unusual Outbound Network Traffic: An increase in odd or questionable outbound network traffic may be a sign that infostealer malware has accessed more data.
- Anomalies in Privileged User Account Activity: Unusual behavior or illegal access are two examples of irregular actions that might indicate a breach in privileged user accounts.
- Suspicious Registry or System File Changes: Infostealer malware may be trying to alter system settings if there are any unexpected changes to system files, registry settings, or configurations.
- Unusual DNS queries: When communicating with command and control servers or rerouting traffic, infostealer malware may produce strange DNS queries.
- Unexpected System Patching: Unexpected or unauthorized system patching by unidentified parties may indicate that infostealer malware has compromised the system and is trying to hide its footprint or become persistent.
- Phishing emails and social engineering attempts: It is a popular strategy employed by cybercriminals to get confidential data or implant malicious software. To avoid compromise, it is crucial to be wary of dubious communications and attempts of social engineering.
Recommendations:
- Be Vigilant: In today's digital world, many cybercrimes threaten online safety, Phishing tricks, fake web pages, and bad links pose real dangers. Carefully check email sources. Examine websites closely. Use top security programs. Follow safe browsing rules. Update software often. Share safety tips. These steps reduce risks. They help keep your online presence secure.
- Regular use of Anti-Virus Software to detect the threats: Antivirus tools are vital for finding and stopping cyber threats. These programs use signature detection and behavior analysis to identify known malicious code and suspicious activities. Updating virus definitions and software-patches regularly, improves their ability to detect new threats. This helps maintain system security and data integrity.
- Provide security related training to the employees and common employees: One should learn Cybersecurity and the best practices in order to keep the office safe. Common workers will get lessons on spotting risks and responding well, creating an environment of caution.
- Keep changing passwords: Passwords should be changed frequently for better security. Rotating passwords often makes it harder for cyber criminals to compromise and make it happen or confidential data to be stolen. This practice keeps intruders out and shields sensitive intel.
Conclusion:
To conclude, to reduce the impact and including the safety measures, further investigations and collaboration are already in the pipeline regarding the recent malicious software that takes advantage of gamers and has stated that about millions of credentials users have been compromised. To protect sensitive data, continued usage of antivirus software, use of trusted materials and password changes are the key elements. The ways to decrease risks and safely protect sensitive information are to develop improved Cybersecurity methods such as multi-factor authentication and the conduct of security audits frequently. Be safe and be vigilant.
Reference:
- https://techcrunch.com/2024/03/28/activision-says-its-investigating-password-stealing-malware-targeting-game-players/
- https://www.bleepingcomputer.com/news/security/activision-enable-2fa-to-secure-accounts-recently-stolen-by-malware/
- https://cyber.vumetric.com/security-news/2024/03/29/activision-enable-2fa-to-secure-accounts-recently-stolen-by-malware/
- https://www.virustotal.com/
- https://otx.alienvault.com/
