Small Words, Big Consequences: Reading the DPDP (Removal of Difficulties) Order, 2026
Introduction
Lawyers love saying that the devil lies in the detail, and privacy professionals in India have had a neat reminder of this. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026, was issued by MeitY on 5 October and published in the Official Gazette on 7 October. It is brief: it makes two editorial corrections to the Digital Personal Data Protection Act, 2023, and these are described by MeitY as textual and editorial corrections that serve to give effect to the intention of the Parliament. This is fair language, but a careful reader will note the importance of the nuances.
What the Order is and what it is not
The Order is based on section 43(1) of the Act that allows the Central Government to make provision not inconsistent with the Act if difficulty arises in giving effect to the Act. This power is subject to some conditions. Section 43(2) states that no such order can be made after the expiry of three years from the commencement, and section 43(3) says that such order shall be laid before each House of the Parliament. So, it is just a tool for tidying up and not for rewriting the Act. According to India Briefing, the Order came into operation on the date of its publication in the Gazette.
Fix one: guardian consent for children and persons with disabilities
Section 9(1) of the Act says a Data Fiduciary must obtain verifiable consent from the parent or lawful guardian before processing the personal data of “a child or a person with disability who has a lawful guardian”. The Order inserts one small preposition so that the provision reads as the personal data of a child or of a person with a disability. As reported, the missing “of” created a grammatical disjunction between the two categories and could cloud the intended meaning, and the fix puts them side by side.
Why would that matter? Here is one way to see the risk, and to be clear, this is my own illustration and not something the Order says. Read the old phrase quickly, and you could ask whether “who has a lawful guardian” qualifies only the person with a disability or whether it also hangs on the child. The Act’s own definitions point to the answer. Section 2(j) treats the parents or lawful guardian of a child and the lawful guardian of a person with a disability as part of the Data Principal in parallel terms. Parallel treatment in the definitions and slightly tangled treatment in the operative clause is exactly the kind of mismatch that invites an argument later. The extra word shuts that door.
The stakes are not small. The Schedule to the Act sets a penalty of up to Rs 200 crore for breach of the additional obligations relating to children under section 9. Nobody wants to be in a hearing where the question is what a missing preposition was supposed to mean.
Fix two: “audit” becomes “data audit"
Section 10 adds duties for Significant Data Fiduciaries. Clause (b) of sub-section (2) requires them to appoint an independent data auditor to carry out a data audit. Clause (c)(ii), a few lines later, requires a “periodic audit” and nothing more. Same section, two audit duties, two slightly different vocabularies. The Order replaces “audit” with “data audit” in section 10(2)(c)(ii).
The reasoning behind the argument given by India Briefing is that the bare word could leave the scope of the audit ambiguous and subject of different interpretations by regulatory or supervisory authorities. One can only speculate what questions an SDF may have had to answer in the meanwhile. Does a periodic audit entail a financial audit, an information security audit, a generic internal audit or something completely different? With the amendment, the periodic audit has been tied to the compliance with data protection and data processing; fitting into the overall audit framework which the Act provides for SDFs. The Order does not combine the two obligations. The independent auditor and the periodic audit remain separate obligations. What changes is that the two now share a common language. The stakes, again, are real here as the Schedule permits a penalty of up to Rs 150 crore for violation of the additional obligations of an SDF under section 10.
Is “editorial” the right label?
Mostly, yes. India Briefing concludes that the Order does not substantially expand the Act’s obligations, and Zee Business reaches a similar view, noting that it clears up wording rather than creating a new compliance system.
Nevertheless, a label is no protection. Labelling it an editorial correction will not stop a regulator or a litigant from asserting that the text previously meant something else or that the amended text now conveys something different. Section 43 only permits the inclusion of provisions that are not inconsistent with the Act, which is exactly the point that the Government takes care to make through this text. My recommendation is that you read the Gazette text (not summaries of it) and retain a copy in your compliance file.
What privacy teams can do now
Nothing here is urgent, and that is the good news. The DPDP Rules, 2025, were notified in November 2025 with a phased timeline, and as Bar and Bench reports, most operational duties are due after an 18-month transition ending on 13 May 2027. The Rules also operationalise age verification and guardian validation, including through Digital Locker based methods, and expect enhanced governance from SDFs, including audits and risk assessments, as Khurana and Khurana notes. That leaves room to make small corrections calmly. A sensible short list looks like this:
- Check the wording of your consent flows. Make sure notices and policies that deal with children and persons with disabilities use language consistent with the amended section 9(1), and that the guardian route is clearly described.
- Align your audit vocabulary. If you are or may be notified as an SDF, use “data audit” consistently in policies, audit charters, checklists and engagement letters with your independent data auditor.
- Update your statutory reference library. Many teams quote the Act in templates and training decks. Those quotes should now match the amended text.
- Set up a Gazette watch. Notifications, rules and orders under this Act will keep arriving.
Conclusion
Privacy work is often couched in terms of grand themes such as consent, accountability and cross-border transfers. In practice, a substantial part of the work takes the form of close reading. Data Fiduciaries, auditors and the Data Protection Board will all be working from the same words, so that the distinction between 'audit' and 'data audit', or between a phrase including or omitting 'of', is the sort of gap that can decide an argument.
We therefore invite you to treat this order as a prompt to read your own documents as a regulator would. Spot points at which two terms are being used for one purpose or one term is being used to cover two purposes. Rectifying such issues now costs an afternoon's work; waiting until an inquiry is underway will require significantly more resources.
Sources
- Digital Personal Data Protection Act, 2023 (official text), Ministry of Electronics and Information Technology
- DPDP (Removal of Difficulties) Order 2026 Clarifies Consent and Data Audit Requirements in India, India Briefing
- DPDP Order 2026 clarifies data protection, consent and data audit requirements for businesses in India, Zee Business
- MeitY notifies final Digital Personal Data Protection Rules 2025, Bar and Bench
- Update: MeitY Notifies Rules Operationalising the DPDP Framework in India, Khurana and Khurana
Related Blogs
.webp)
Executive Summary
This report analyses a recently launched social engineering attack that took advantage of Microsoft Teams and AnyDesk to deliver DarkGate malware, a MaaS tool. This way, through Microsoft Teams and by tricking users into installing AnyDesk, attackers received unauthorized remote access to deploy DarkGate that offers such features as credential theft, keylogging, and fileless persistence. The attack was executed using obfuscated AutoIt scripts for the delivery of malware which shows how threat actors are changing their modus operandi. The case brings into focus the need to put into practice preventive security measures for instance endpoint protection, staff awareness, limited utilization of off-ice-connection tools, and compartmentalization to safely work with the new and increased risks that contemporary cyber threats present.
Introduction
Hackers find new technologies and application that are reputable for spreading campaigns. The latest use of Microsoft Teams and AnyDesk platforms for launching the DarkGate malware is a perfect example of how hackers continue to use social engineering and technical vulnerabilities to penetrate the defenses of organizations. This paper focuses on the details of the technical aspect of the attack, the consequences of the attack together with preventive measures to counter the threat.
Technical Findings
1. Attack Initiation: Exploiting Microsoft Teams
The attackers leveraged Microsoft Teams as a trusted communication platform to deceive victims, exploiting its legitimacy and widespread adoption. Key technical details include:
- Spoofed Caller Identity: The attackers used impersonation techniques to masquerade as representatives of trusted external suppliers.
- Session Hijacking Risks: Exploiting Microsoft Teams session vulnerabilities, attackers aimed to escalate their privileges and deploy malicious payloads.
- Bypassing Email Filters: The initial email bombardment was designed to overwhelm spam filters and ensure that malicious communication reached the victim’s inbox.
2. Remote Access Exploitation: AnyDesk
After convincing victims to install AnyDesk, the attackers exploited the software’s functionality to achieve unauthorized remote access. Technical observations include:
- Command and Control (C2) Integration: Once installed, AnyDesk was configured to establish persistent communication with the attacker’s C2 servers, enabling remote control.
- Privilege Escalation: Attackers exploited misconfigurations in AnyDesk to gain administrative privileges, allowing them to disable antivirus software and deploy payloads.
- Data Exfiltration Potential: With full remote access, attackers could silently exfiltrate data or install additional malware without detection.
3. Malware Deployment: DarkGate Delivery via AutoIt Script
The deployment of DarkGate malware utilized AutoIt scripting, a programming language commonly used for automating Windows-based tasks. Technical details include:
- Payload Obfuscation: The AutoIt script was heavily obfuscated to evade signature-based antivirus detection.
- Process Injection: The script employed process injection techniques to embed DarkGate into legitimate processes, such as explorer.exe or svchost.exe, to avoid detection.
- Dynamic Command Loading: The malware dynamically fetched additional commands from its C2 server, allowing real-time adaptation to the victim’s environment.
4. DarkGate Malware Capabilities
DarkGate, now available as a Malware-as-a-Service (MaaS) offering, provides attackers with advanced features. Technical insights include:
- Credential Dumping: DarkGate used the Mimikatz module to extract credentials from memory and secure storage locations.
- Keylogging Mechanism: Keystrokes were logged and transmitted in real-time to the attacker’s server, enabling credential theft and activity monitoring.
- Fileless Persistence: Utilizing Windows Management Instrumentation (WMI) and registry modifications, the malware ensured persistence without leaving traditional file traces.
- Network Surveillance: The malware monitored network activity to identify high-value targets for lateral movement within the compromised environment.
5. Attack Indicators
Trend Micro researchers identified several indicators of compromise (IoCs) associated with the DarkGate campaign:
- Suspicious Domains: example-remotesupport[.]com and similar domains used for C2 communication.
- Malicious File Hashes:some text
- AutoIt Script: 5a3f8d0bd6c91234a9cd8321a1b4892d
- DarkGate Payload: 6f72cde4b7f3e9c1ac81e56c3f9f1d7a
- Behavioral Anomalies:some text
- Unusual outbound traffic to non-standard ports.
- Unauthorized registry modifications under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
Broader Cyber Threat Landscape
In parallel with this campaign, other phishing and malware delivery tactics have been observed, including:
- Cloud Exploitation: Abuse of platforms like Cloudflare Pages to host phishing sites mimicking Microsoft 365 login pages.
- Quishing Campaigns: Phishing emails with QR codes that redirect users to fake login pages.
- File Attachment Exploits: Malicious HTML attachments embedding JavaScript to steal credentials.
- Mobile Malware: Distribution of malicious Android apps capable of financial data theft.
Implications of the DarkGate Campaign
This attack highlights the sophistication of threat actors in leveraging legitimate tools for malicious purposes. Key risks include:
- Advanced Threat Evasion: The use of obfuscation and process injection complicates detection by traditional antivirus solutions.
- Cross-Platform Risk: DarkGate’s modular design enables its functionality across diverse environments, posing risks to Windows, macOS, and Linux systems.
- Organizational Exposure: The compromise of a single endpoint can serve as a gateway for further network exploitation, endangering sensitive organizational data.
Recommendations for Mitigation
- Enable Advanced Threat Detection: Deploy endpoint detection and response (EDR) solutions to identify anomalous behavior like process injection and dynamic command loading.
- Restrict Remote Access Tools: Limit the use of tools like AnyDesk to approved use cases and enforce strict monitoring.
- Use Email Filtering and Monitoring: Implement AI-driven email filtering systems to detect and block email bombardment campaigns.
- Enhance Endpoint Security: Regularly update and patch operating systems and applications to mitigate vulnerabilities.
- Educate Employees: Conduct training sessions to help employees recognize and avoid phishing and social engineering tactics.
- Implement Network Segmentation: Limit the spread of malware within an organization by segmenting high-value assets.
Conclusion
Using Microsoft Teams and AnyDesk to spread DarkGate malware shows the continuous growth of the hackers’ level. The campaign highlights how organizations have to start implementing adequate levels of security preparedness to threats, including, Threat Identification, Training employees, and Rights to Access.
The DarkGate malware is a perfect example of how these attacks have developed into MaaS offerings, meaning that the barrier to launch highly complex attacks is only decreasing, which proves once again why a layered defense approach is crucial. Both awareness and flexibility are still the key issues in addressing the constantly evolving threat in cyberspace.
Reference:
Executive Summary
A video widely circulated on social media claims to show a confrontation between a Zee News journalist and Chief of Army Staff (COAS) General Upendra Dwivedi during the Indian Army’s Annual Press Briefing 2026. The video alleges that General Dwivedi made sensitive remarks regarding ‘Operation Sindoor’, including claims that the operation was still ongoing and that diplomatic intervention by former US President Donald Trump had restricted India’s military response. Several social media users shared the clip while questioning the Indian Army’s operational decisions and demanding accountability over the alleged remarks. The CyberPeace concludes that the viral video claiming to show a discussion between a Zee News journalist and Chief of Army Staff General Upendra Dwivedi on ‘Operation Sindoor’ is misleading and digitally manipulated. Although the visuals were sourced from the Indian Army’s Annual Press Briefing 2026, the audio was artificially created and added later to misinform viewers. The Army Chief did not make any remarks regarding diplomatic interference or limitations on military action during the briefing.
Claim:
An X (formerly Twitter) user, Abbas Chandio (@AbbasChandio__), shared the video on January 14, asserting that it showed a Zee News journalist questioning the Army Chief about the status and outcomes of ‘Operation Sindoor’ during a recent press conference. In the clip, the journalist is purportedly heard challenging the Army Chief over his earlier statement that the operation was “still ongoing,” while the COAS is allegedly heard responding that diplomatic intervention during the conflict limited the Army’s ability to pursue further military action. Here is the link and archive link to the post, along with a screenshot.
The reverse image search also directed to an extended version of the footage uploaded on the official YouTube channel of India Today. The original video was identified as coverage from the Indian Army’s Annual Press Conference 2026, held on January 13 in New Delhi and addressed by COAS General Upendra Dwivedi. Upon reviewing the original press briefing footage, CyberPeace found no instance where a Zee News journalist questioned the Army Chief about ‘Operation Sindoor’. There was also no mention of the statements attributed to General Dwivedi in the viral clip.
In the authentic footage, journalist Anuvesh Rath was seen raising questions related to defence procurement and modernization, not military operations or diplomatic interventions. Here is the link to the original video, along with a screenshot.
To further verify the claim, CyberPeace extracted the audio track from the viral video and analysed it using the AI-based voice detection tool Aurigin. The analysis revealed that the voice heard in the clip was artificially generated, indicating the use of synthetic or manipulated audio. This confirmed that while genuine visuals from the Army’s official press briefing were used, a fabricated audio track had been overlaid to falsely attribute controversial statements to the Army Chief and a Zee News journalist.
Conclusion
The CyberPeace concludes that the viral video claiming to show a discussion between a Zee News journalist and Chief of Army Staff General Upendra Dwivedi on ‘Operation Sindoor’ is misleading and digitally manipulated. Although the visuals were sourced from the Indian Army’s Annual Press Briefing 2026, the audio was artificially created and added later to misinform viewers. The Army Chief did not make any remarks regarding diplomatic interference or limitations on military action during the briefing. The video is a clear case of digital manipulation and misinformation, aimed at creating confusion and casting doubts over the Indian Army’s official position.
A video is being widely shared on social media showing a monkey, with users claiming that the animal is immersed in devotion to Lord Hanuman. The clip is being circulated with assertions that the monkey was seen participating in Hanuman Aarti. Cyber Peace Foundation’s research found that the viral claim is fake. Our investigation revealed that the video is not real and has been generated using artificial intelligence tools.
Claim
On January 6, 2026, Facebook users shared the viral video claiming, “A monkey was seen immersed in devotion during Hanuman Aarti.”
- Post link: https://www.facebook.com/reel/1261813845766976
- Archived link: https://archive.ph/anid5
Screenshots of the post can be seen below.
FactCheck:
When we closely examined the viral video, we noticed several visual inconsistencies. These anomalies raised suspicion that the video might be AI-generated. To verify this, we scanned the video using the AI detection tool Hive Moderation. According to the results, the video was found to be 97 percent AI-generated.
Further, we analysed the video using another AI detection tool, Sightengine. The tool’s assessment indicated that the viral video is 98 percent AI-generated.
Conclusion
Our investigation confirms that the viral video claiming to show a monkey immersed in devotion to Lord Hanuman is AI-generated and not real. The claim circulating on social media is false and misleading.
