#FactCheck- Indian Navy Video from Seychelles Exercise Passed Off as Anti-Piracy Action
Executive Summary
A video showing armed personnel detaining individuals on board a ship is being widely shared on social media with the claim that Indian Navy’s MARCOS captured 35 Somali pirates during a recent anti-piracy operation. However, research by the CyberPeace Research Wing found the claim to be misleading. The viral video is actually from the joint military exercise ‘LAMITIYE 2026’, held in Seychelles in March, involving the Indian Armed Forces and the Seychelles Defence Forces.
Claim
Users on X (formerly Twitter) shared the clip with captions such as: “Indian Navy MARCOS captured 35 Somali pirates,” presenting it as footage of a recent anti-piracy mission.
Fact Check
To verify the claim, we extracted keyframes from the viral video and conducted a reverse image search. This led us to the same video posted on March 20 by a Facebook page named “Defence Squad.” The caption identified the visuals as showing Indian Navy MARCOS and the Seychelles Defence Forces’ Special Operations Unit during the joint military exercise LAMITIYE 2026.
Link:
- https://www.facebook.com/reel/1263962865936234
- https://www.facebook.com/reel/1263962865936234
Further keyword searches led to multiple news reports carrying screenshots from the same video. These reports confirmed that the 11th India-Seychelles joint military exercise, LAMITIYE 2026, was conducted in Seychelles from March 9 to March 20.
We did not find any recent reports about the Indian Navy capturing Somali pirates. However, in March 2024, the Indian Navy had captured 35 Somali pirates who had hijacked a bulk carrier and taken hostages. The suspects were later handed over to Mumbai Police for legal proceedings.
Conclusion
The viral claim is misleading. The video being circulated as footage of an anti-piracy operation by the Indian Navy does not show the capture of Somali pirates. Instead, it is from the India-Seychelles joint military exercise ‘LAMITIYE 2026’, conducted in March with the participation of the Indian Armed Forces and the Seychelles Defence Forces. While the Indian Navy had indeed captured 35 Somali pirates in a separate incident in March 2024, there are no credible or recent reports linking such an operation to the viral video. The clip has been taken out of context and is being shared with a false narrative, leading to misinformation about a routine military exercise.
Related Blogs
Amid reports of widespread protests in Iran over the past two weeks, a video showing protesters setting cars on fire is being widely shared on social media with claims that it depicts recent unrest in the country.
However, research by Cyber Peace Foundation has found the viral claim to be false. Our resarch shows that the video is not from Iran, but from violent protests that took place near the Turkish Consulate in Thessaloniki, Greece, on November 1, 2025.
Claim:
On January 11, 2026, users on social media platform X (formerly Twitter) shared the viral video claiming it showed massive anti-regime protests in Iran. One such post alleged:
“1.5–1.85 million Iranians are fighting on the streets tonight. 180 cities are burning… The revolution has spread. Iranians have decided to continue this fight for freedom until Iran becomes free from Islamic rule.”
The post’s link and archived version can be seen below: (Link and archive link)
Fact Check:
To verify the claim, we extracted keyframes from the viral video and conducted a Google Reverse Image Search. During this process, we found the same video uploaded on Instagram on November 2, 2025, well before the recent protests in Iran. (Link): https://www.instagram.com/reel/DQjRtCOjOPM/
Further analysis revealed that the video was uploaded from a Greek Instagram account, indicating that the visuals are unrelated to Iran.
It is important to note that while protests in Iran have been ongoing for the past two weeks, the viral video has been circulating on the internet since early November 2025, establishing a clear timeline mismatch.
A keyword search led us to a report published on November 2, 2025, by Ekathimerini, a leading Greek media outlet. The report detailed violent clashes that erupted in Thessaloniki following a concert by Greek rapper Lex.
According to the report:
Police in Thessaloniki detained 18 people and arrested one individual on drug-related charges. The unrest began when a group attacked police forces stationed outside the Turkish Consulate. During the clashes, six cars were damaged, two of them completely burned, along with a garbage bin. ( report link and screenshot)
In the next stage of the investigation, we found similar visuals to the viral video on a YouTube channel named “Taifer”, where the footage was published on November 2, 2025. The link to the post and its screenshot can be seen below.
(YouTube link): https://www.youtube.com/watch?v=TejETjQRmTQ
To strengthen our findings, we conducted a geolocation analysis of the video. By comparing road layouts, surrounding buildings, light poles, and other visual markers with online maps and images, we confirmed that the location shown in the video matches Agios Dimitriou Street in Thessaloniki, Greece.
(Location link)
Our research clearly establishes that the viral video being shared as footage of recent protests in Iran is misleading. The video actually shows violent demonstrations near the Turkish Consulate in Thessaloniki, Greece, on November 1, 2025, and has no connection to the current situation in Iran.
Introduction
For most of us, UPI is part of daily routine: scan a QR code for chai, send money to family, split a bill, or pay a shopkeeper in seconds. That convenience is exactly why a message saying “UPI charges are coming” can cause confusion. Scammers can use that uncertainty through fake calls, WhatsApp messages, payment links, or edited screenshots. This blog keeps the topic simple: what MDR means, which UPI payments remain free, how scammers misuse the word “fee”, and what a reader should do when a payment request does not look right.
News in Focus: Why the “UPI Charge” Headline Needs Context
On 15 September 2026, the Ministry of Finance clarified the revised UPI framework. From 15 October 2026, a 0.4% MDR will apply to specified P2M transactions above ₹2,000, subject to the published conditions and caps. P2P transfers remain free, payments to merchants up to ₹2,000 remain free, and the government states that MDR is an ecosystem charge, not a customer fee. Banks are to ensure it is not passed on to customers. [1]
So, What Does This Mean for an Everyday User?
The important distinction is between a legitimate MDR rule and a scammer’s request for money. A message saying “pay ₹99 to release your UPI transaction” is not made genuine by mentioning NPCI, a bank, a government notice, or a news report.
A Related Cyber-Fraud Headline: Do Not Mix Two Different Issues
The supplied newspaper clipping discusses a separate cyber-fraud issue involving suspicious transactions and bank accounts linked to cybercrime. It is useful context, but it should not be read as proof that ordinary UPI users must pay a special “verification” or “release” fee. Separating the two issues helps prevent panic and misinformation.
Where Scammers Use the Confusion
“Pay a small fee to receive money”
A simple red flag is the demand for an upfront fee: “Your refund is ready, pay a processing fee first.” NPCI warns that scanning a QR code and entering a UPI PIN is for making a payment, not for receiving money or cashback. [2]
Fake payment success screens
Another common trick targets merchants: a fraudster shows a convincing “Payment Successful” screenshot and collects goods before the seller checks the account. In August 2026, Delhi Police reported a case involving allegedly fake or manipulated Paytm/UPI screenshots, followed by an attempt to gain access to victims’ mobile phones. [3] In September, police in Jharsuguda and Basti reported similar fake-confirmation cases; the Basti case involved a fabricated SBI YONO screenshot. [4][5]
“Your UPI is blocked because of new charges”
Scammers also borrow the language of genuine policy announcements. The caller creates urgency, claims your account is restricted, and asks you to install an app, share an OTP, approve a collect request, or transfer a small amount “for verification”. A real headline does not make an unexpected payment request genuine.
The Five-Second UPI Safety Check
Puse Before You Pay
WHO is asking? WHAT exactly are they asking you to do? WHERE did the payment request appear? WHEN did the request arrive? WHY would you need to pay to receive money? Verify the transaction in your own bank or UPI app. Merchants should not rely on a screenshot shown by a customer. Customers should not treat a QR code, collect request, or incoming message as proof that they are “receiving” money. Read the final authorisation screen before entering the UPI PIN. NPCI says users should never share the PIN and that bank customer support will not ask for it. [6]
If You Think You Have Been Scammed
- Stop engaging with the suspected caller, account, or chat. Do not send another payment to “fix” the first one.
- Contact your bank or the relevant payment app using an official support channel and report the transaction.
- For financial cyber fraud in India, call 1930 as soon as possible and report the incident through the National Cyber Crime Reporting Portal. The official portal identifies 1930 as the helpline for immediate reporting of financial cyber fraud. [7]
- Keep the transaction ID, screenshots, phone numbers, messages, and dates. Do not delete useful evidence.
Conclusion
The safest way to understand the UPI charge discussion is to slow the headline down. Yes, a revised MDR framework has been announced for certain merchant transactions above ₹2,000 from 15 October 2026. But that does not make a P2P transfer subject to a “release fee”, and it does not make an unsolicited ₹49, ₹99, or ₹199 demand legitimate. Check the transaction type, confirm where the charge sits, verify the payment in your own app or bank account, and never disclose your UPI PIN. Digital safety is not about fearing every payment; it is about recognising when someone asks you to leave the normal payment process.
Remember
UPI convenience should never require blind trust. Verify the sender, verify the screen, verify the transaction.
References
[1] Press Information Bureau, Ministry of Finance, “UPI Continues to Remain Free for Peer to Peer Transactions and 96% of Merchant Transactions,” 15 September 2026. https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2310586
[2] National Payments Corporation of India (NPCI), “Fraud Awareness,” current guidance on fake cashback links, QR codes and UPI PIN safety. https://www.npci.org.in/fraud-awareness
[3] Hindustan Times / PTI, “Delhi Police arrest man in ₹30.81 lakh cyber fraud involving fake UPI payments,” 26 August 2026. https://www.hindustantimes.com/cities/delhi-news/delhi-police-arrest-man-in-rs-30-81-lakh-cyber-fraud-involving-fake-upi-payments-101787734051785.html
[4] The Times of India, “Two held for fake UPI payment fraud in Jharsuguda,” 11 September 2026. https://timesofindia.indiatimes.com/city/bhubaneswar/two-held-for-fake-upi-payment-fraud-in-jharsuguda/articleshow/134072823.cms
[5] The Times of India, “Basti: 2 held for fake UPI payment scam,” 13 September 2026. https://timesofindia.indiatimes.com/articleshow/134154561.cms
[6] NPCI, “UPI - Frequently Asked Questions,” UPI PIN and transaction-confirmation guidance. https://www.npci.org.in/what-we-do/upi/faqs
[7] Government of India, National Cyber Crime Reporting Portal, financial cyber fraud reporting guidance and helpline 1930. https://www.cybercrime.gov.in/
[8] Moneycontrol, “Don't trust the screenshot: How to spot a fake UPI payment,” 6 August 2026. https://www.moneycontrol.com/news/business/personal-finance/don-t-trust-the-screenshot-how-to-spot-a-fake-upi-payment-13996275.html
Image note: Both visuals were supplied by the requester. Figure 1 was cross-checked against the Ministry of Finance/PIB clarification cited in Reference [1].
Introduction
In the labyrinthine world of cybersecurity, a new spectre has emerged from the digital ether, casting a long shadow over the seemingly impregnable orchards of Apple's macOS. This phantom, known as SpectralBlur, is a backdoor so cunningly crafted that it remained shrouded in the obscurity of cyberspace, undetected by the vigilant eyes of antivirus software until its recent unmasking. The discovery of SpectralBlur is not just a tale of technological intrigue but a narrative that weaves together the threads of geopolitical manoeuvring, the relentless pursuit of digital supremacy, and the ever-evolving landscape of cyber warfare.
SpectralBlur, a term that conjures images of ghostly interference and elusive threats, is indeed a fitting moniker for this new macOS backdoor threat. Cybersecurity researchers have peeled back the layers of the digital onion to reveal a moderately capable backdoor that can upload and download files, execute shell commands, update its configuration, delete files, and enter states of hibernation or sleep, all at the behest of a remote command-and-control server. Greg Lesnewich, a security researcher whose name has become synonymous with the relentless pursuit of digital malefactors, has shed light on this new threat that overlaps with a known malware family attributed to the enigmatic North Korean threat actors.
SpectralBlur similar to Lazarus Group’s KANDYKORN
The malware shares its DNA with KANDYKORN, also known as SockRacket, an advanced implant that functions as a remote access trojan capable of taking control of a compromised host. It is a digital puppeteer, pulling the strings of infected systems with a malevolent grace. The KANDYKORN activity also intersects with another campaign orchestrated by the Lazarus sub-group known as BlueNoroff, or TA444, which culminates in the deployment of a backdoor referred to as RustBucket and a late-stage payload dubbed ObjCShellz.
Recently, the threat actor has been observed combining disparate pieces of these two infection chains, leveraging RustBucket droppers to deliver KANDYKORN. This latest finding is another sign that North Korean threat actors are increasingly setting their sights on macOS to infiltrate high-value targets, particularly those within the cryptocurrency and blockchain industries. 'TA444 keeps running fast and furious with these new macOS malware families,' Lesnewich remarked, painting a picture of a relentless adversary in the digital realm.
Patrick Wardle, a security researcher whose insights into the inner workings of SpectralBlur have further illuminated the threat landscape, noted that the Mach-O binary was uploaded to the VirusTotal malware scanning service in August 2023 from Colombia. The functional similarities between KANDYKORN and SpectralBlur have raised the possibility that they may have been built by different developers with the same requirements. What makes the malware stand out are its attempts to hinder analysis and evade detection while using grant to set up a pseudo-terminal and execute shell commands received from the C2 server.
The disclosure comes as 21 new malware families designed to target macOS systems, including ransomware, information stealers, remote access trojans, and nation-state-backed malware, were discovered in 2023, up from 13 identified in 2022. 'With the continued growth and popularity of macOS (especially in the enterprise!), 2024 will surely bring a bevvy of new macOS malware,' Wardle noted, his words a harbinger of the digital storms on the horizon.
Hackers are beefing up their efforts to go after the best MacBooks as security researchers have discovered a brand new macOS backdoor which appears to have ties to another recently identified Mac malware strain. As reported by Security Week, this new Mac malware has been dubbed SpectralBlur and although it was uploaded to VirusTotal back in August of last year, it remained undetected by the best antivirus software until it recently caught the attention of Proofpoint’s Greg Lesnewich.
Lesnewich explained that SpectralBlur has similar capabilities to other backdoors as it can upload and download files, delete files and hibernate or sleep when given commands from a hacker-controlled command-and-control (C2) server. What is surprising about this new Mac malware strain though is that it shares similarities to the KandyKorn macOS backdoor which was created by the infamous North Korean hacking group Lazarus.
Just like SpectralBlur, KandyKorn is designed to evade detection while providing the hackers behind it with the ability to monitor and control infected Macs. Although different, these two Mac malware strains appear to be built based on the same requirements. Once installed on a vulnerable Mac, SpectralBlur executes a function that allows it to decrypt and encrypt network traffic to help it avoid being detected. However, it can also erase files after opening them and then overwrite the data they contain with zeros..
How to keep your Apple computers safe from hackers
As with the best iPhones, keeping your Mac up to date is the easiest and most important way to keep it safe from hackers. Hackers often prey on users who haven’t updated their devices to the latest software as they can exploit unpatched vulnerabilities and security flaws.
Checking to see if you're running the latest macOS version is quite easy. Just click on the Apple Logo in the top right corner of your computer, head to System Preferences and then click on Software Update. If you need a bit more help, check out our guide on how to update a Mac for more detailed instructions with pictures.
Even though your Mac has its own built-in malware scanner from Apple called xProtect, you should consider using one of the best Mac antivirus software solutions for additional protection. Paid antivirus software is often updated more frequently and you often also get access to other extras to help keep you safe online like a password manager or a VPN.
Besides updating your Mac frequently and using antivirus software, you must be careful online. This means sticking to trusted online retailers, carefully checking the URLs of the websites you visit and avoiding opening links and attachments sent to you via email or social media from people you don’t know. Likewise, you should also learn how to spot a phishing scam to know which emails you want to delete right away.
Conclusion
The thing about hackers and other cybercriminals is that they are constantly evolving their tactics and attack methods. This helps them avoid detection and allows them to devise brand-new ways to trick ordinary people. With the surge we saw in Mac malware last year, though, Apple will likely be working on beefing up xProtect and macOS to better defend against these new threats.
References
- https://www.scmagazine.com/news/new-macos-malware-spectralblur-idd-as-north-korean-backdoor
- https://www.tomsguide.com/news/this-new-macos-backdoor-lets-hackers-take-over-your-mac-remotely-how-to-stay-safe
- https://thehackernews.com/2024/01/spectralblur-new-macos-backdoor-threat.html
