Sold into the Scam: India's Cyber Slavery Crisis and the Southeast Asian Digital Trafficking Network
Introduction
When Tamil Nadu Police arrested a man from Vellore in May 2026 on suspicion of being the point person helping Indian youth to be smuggled into cyber scam compounds in Cambodia, the papers led with the accused. They shouldn't have led with the accused but with the system. The arrest, one in a long string of them in Tamil Nadu, Madurai, and other states, is not simply another one-off policing victory. Rather, the arrest gives us an insight into a larger, darker world: an international criminal organisation that has successfully combined human trafficking and cybercrime, a new trend in criminality that specialists are calling 'cyber slavery.'
What Is Cyber Slavery?
“Cyber slavery” involves trafficking persons under the pretence of employment, forcing them into committing online fraud to serve criminal enterprises. Victims are not merely victims of the work they are forced to do; they are often turned into culprits as they become complicit in victimising others. Trafficked victims are compelled to participate in frauds targeted at unsuspecting victims all around the globe. These activities, organised into robust criminal schemes, involve victims of sex or labour trafficking who are forced into operating romance scams or the so-called "pig butchering" scams that defraud people of their investment in cryptocurrency, all in heavily secured complexes guarded with threats of violence and torture. The extent of the problem is enormous, with the UN Office of the High Commissioner for Human Rights estimating in a 2023 report that there are over 100,000 victims of cyber scam compounds in Cambodia and another 120,000 in Myanmar. Schemes throughout Southeast Asia were projected to commit as much as $39.9 billion in fraudulent schemes a year.
Why Southeast Asia? The Geography of Organised Crime
In order to answer why Cambodia, Myanmar, Laos, and the surrounding regions have developed into the cyber slavery hub of the world, we can draw together an array of structural reasons:
- Casino clampdown and crime diversification: Cambodia's ban on online gambling in 2019 broke down established casino-related criminal networks. This saw old casinos and Special Economic Zones turn into cyber scam compound operations.
- Corruption and state complicity: A pre-existing environment of corruption and involvement of politically linked figures permitted scamming networks to flourish, and the armed groups in the border areas of Myanmar are reportedly complicit in these operations through supplying land and protection for the networks to operate in.
- Poor governance in the border areas: The lack of state control in the frontier areas of Myanmar provided the criminal networks with a secure sanctuary in which they could operate with impunity and cross borders to escape crackdowns and move their operations.
- Post-pandemic growth: The economic stress associated with the COVID-19 pandemic led to an increase in the supply of vulnerable individuals available to fill the scam networks, as well as unprecedented profit margins on scams.
The Recruitment Pipeline: How Are Indian Youth Trapped?
The typical journey from an Indian town or village to a locked compound in Southeast Asia follows the same narrative:
- The bait: On platforms like Facebook, WhatsApp, and Telegram, gangs lure with posts of lucrative overseas employment for IT work, customer service, data entry, and digital marketing with attractive, albeit feasible, pay packages (Rs. 80,000 to Rs. 1.5 lakh per month) and destinations such as Thailand and Singapore added for a veneer of genuineness.
- The recruiters: Local agents who gain trust, arrange visas and flight tickets, and collect the application fees are key intermediaries. Cases registered in Vellore and Madurai hint at recruitment agents receiving a commission for each person successfully smuggled into a trap, linked to larger travel and immigration networks.
- The lie: Victims are assured that they will be working legitimately in Thailand, but on reaching the border and crossing over, they find themselves pushed into scam compounds in neighbouring countries and have their passports, mobile phones and devices confiscated, thus rendering any escape attempt futile.
- The trap: In the interim, fake interviews, false job promises and convincing flight tickets serve to maintain the facade until the victims are forced to participate in cyber-fraud schemes.
The Architecture of Coercion: Life Inside the Scam Compounds
It is in these compounds that the fates of the victims become known. Survivor accounts, investigations and UN human rights reports provide evidence of these circumstances. These compounds are often surrounded by barbed wire fences, monitored with cameras and heavily guarded. Once a potential victim is captured, they are stripped of their passports and any other electronic devices, preventing them from being able to contact the outside world or to escape. Workers are allocated stringent targets, ranging from the number of potential victims they must solicit for scams and the amount of money they must acquire through such scams. Failure to do so, or perceived disobedience, may lead to beatings, electroshock treatment, starvation and long periods in confinement. These beatings are supplemented with psychological torture, with scammers assuring their victims that they owe money for their journey, stay and training. This method of debt bondage keeps people at the compound even when the opportunity for escape is presented to them. The victims are then forced to take part in more complex online scams, which involve romance scams, fake investment scams, and impersonation scams using scripts and with supervision. In some cases, families will be encouraged to pay for their captive relatives' release by ransom, whereas those who refuse to comply or meet performance requirements may be sold and transferred to another compound as a piece of property within a transnational criminal network.
Cybercrime Is No Longer Just About Hacking
This emergency challenges the existing notion of cybercrime. The scam compound of Southeast Asia is not about a lonely hacker or a standalone breach; it is a form of organised cyber slavery in which trafficked individuals are made to commit financial fraud on an industrial level.
The probe of India's NIA found that recruitment is done in the Indian states of Bihar and Uttar Pradesh. Transport agents in Chennai and Madurai provide logistics, and Dubai and Bangkok act as transit points on the way to Cambodia, Laos, and Vietnam. It makes use of cryptocurrency wallets, shadow banking, and shell companies for the movement of funds across international borders. Companies such as the Huione Group has been accused of facilitating billions of dollars in financial transactions for scam infrastructure before receiving sanctions from the U.S.
To illustrate the threat landscape, the U.S. Treasury imposed sanctions on 19 entities spread across Myanmar and Cambodia and said that cyber scam operations looted $10 billion worth last year. Also, cryptocurrency transactions related to trafficking crimes jumped by 85% last year, which speaks to the expanding nature of the global criminal infrastructure.
India's Exposure: A National Vulnerability
The scale of exposure for India is large and expanding. The most likely victims are educated, and aspirational young men and women from Tier 2 and Tier 3 cities, seeking work abroad, which perfectly aligns with the primary target of such human trafficking networks.
Repeated incidents of people from Tamil Nadu falling victim to these networks have come to light. As far back as 2022, the chief minister wrote to the prime minister that close to 300 Indians, roughly 50 Tamils included, were being held in Myanmar. The Madurai-Cambodia case that came to light in 2026 revealed an entire network spanning Cambodia, Laos, and Vietnam, with authorities believing that thousands of Indians might have been trafficked there over the past three years. Such cases from Kerala, Karnataka, Andhra Pradesh, and some northern Indian states have been reported. Last year, India had to charter Air Force flights to rescue over 549 Indians from cyber scam centres along the Myanmar-Thailand border.
The Indian embassy in Phnom Penh assisted the Indian nationals along with the CBI, MEA, and NIA in the rescue of 67 Indians in September 2024; however, these operations are largely reactive in the face of the vast and evolving transboundary crisis.
Prevention
The best solution is awareness. The following are tangible signs that a job offer might be a lead to trafficking:
Red Flags within the job offer:
- Receiving unsolicited recruitment messages on WhatsApp, Telegram or Instagram from unknown numbers/contacts.
- Offer of unbelievably high salaries in undefined roles like ‘data entry,’ ‘online marketing’ or ‘customer service’ outside India.
- Request for upfront money to cover costs of visas, travel, accommodation, and training.
- Job offers to places in Thailand or Singapore involving complex transit routes through other countries.
- An interview process entirely through messaging apps, where the company has no real office address or registration number.
- Urgency and/or confidentiality required.
Verification:
- Check if the recruiter is registered on MEA's e-Migrate portal-this is a portal where MEA lists authorised overseas recruiters.
- Verify the authenticity of the company through its business registration with official registries in the foreign country.
- Contact the Indian Embassy/Consulate in that foreign country if something doesn't add up about the offer.
- Do not hand over your passport to your employer on arrival; it is standard practice for recruiters working as traffickers to confiscate it.
What to do if trapped:
- Contact the closest Indian embassy or consulate immediately.
- Call the MEA overseas helpline: 1800-11-3090.
- Lodge a report on the National Cybercrime Reporting Portal (cybercrime.gov.in).
Policy Imperatives
On their own, individual consciousness cannot undo such a massive criminal infrastructure. India has to enforce the Emigration Act rigorously, implement mandatory licensing of recruitment agents and create a specialised task force consisting of NIA, CBI, MEA and the states’ cybercrime units. Pre-departure orientations should also become mandatory for migrant workers who go to Southeast Asia. Globally, India needs to work more closely with Cambodia, Myanmar, Thailand and Laos via intel sharing protocols, victim repatriations and action against scam compounds. Financial probes must be on par with enforcement investigations to catch up with the perpetrators’ network, the cryptocurrency and hawala channels that facilitate money laundering and finance trafficking operations, as that would severely hit these networks.
Conclusion
This arrest of the recruiter in Vellore is just a small piece of a larger network. What we see in these instances is the marriage of cybercrime, trafficking, and financial fraud into a larger transnational ecosystem that systematically preys on the economic vulnerability of individuals. These young Indians are not simply falling for scams; they are being systematically targeted, recruited, trafficked, and forced into these criminal operations by a networked structure. The scam compounds in Cambodia and along the border of Myanmar and Thailand are only the end of a process that very likely starts with a convincing job offer on social media. Fighting cyber slavery will not be as simple as more arrests; we need education and international efforts, as well as policy responses that match the scope and scale of the problem.
References
- https://the420.in/78415-2vellore-man-cambodia-cyber-slavery-trafficking-case/
- https://the420.in/madhan-vadivel-cambodia-cyber-slavery-trafficking-racket-investigation/
- https://www.newsonair.gov.in/tamil-nadu-police-arrest-key-recruiter-in-cambodia-cyber-slavery-racket/
- https://kashmirdotcom.in/2026/05/16/cambodia-linked-human-trafficking-cyber-slavery-racket-nia-chargesheets-five-including-absconding-kingpin/
- https://www.aljazeera.com/news/2025/7/16/more-than-1000-arrested-in-cambodian-cyber-scam-raids
- https://www.pbs.org/newshour/world/why-southeast-asias-online-scam-industry-is-so-hard-to-shut-down
- https://www.cfr.org/articles/how-myanmar-became-global-center-cyber-scams
- https://www.amlrightsource.com/resources/scam-states-the-cybercrime-corruption-complex-in-southeast-asia-and-the-collapse-of-anti-money-laundering-enforcement
- https://newlinesinstitute.org/global-security-mil-priorities/cybercrimes-human-trafficking-and-cryptocurrency-in-southeast-asias-special-economic-zones/
- https://www.theweek.in/news/india/2026/03/21/lured-by-jobs-sold-into-slavery-indias-crackdown-on-cyber-trafficking-continues.html
Related Blogs
.webp)
Introduction
Pagers were commonly utilized in the late 1990s and early 2000s, especially in fields that needed fast, reliable communication and swift alerts and information sharing. Pagers typically offer a broader coverage range, particularly in remote areas with limited cellular signals, which enhances their dependability. They are simple electronic devices with minimal features, making them easy to use and less prone to technical issues. The decline in their use has been caused by the rise of mobile phones and their extensive features, offering more advanced communication options like voice calls, text messages, and internet access. Despite this, pagers are still used in some specific industries.
A shocking incident occurred on 17th September 2014, where thousands of pager devices exploded within seconds across Lebanon in a synchronized attack, targeting the US-designated terror group Hezbollah. The explosions killed at least 9 and injured over 2,800 individuals in the country that has been caught up in the Israel-Palestine tensions in its backyard.
The Pager Bombs Incident
On Tuesday, 17th September 2024, hundreds of pagers carried by Hezbollah members in Lebanon exploded in an unprecedented attack, surpassing a series of covert assassinations and cyber-attacks in the region over recent years. The Iran-backed militant group claimed the wireless devices began to explode around 3:30 p.m., local time, in a targeted attack on Hezbollah operatives. The pagers that exploded were new and had been purchased by Hezbollah in recent months. Experts say the explosions underscore Hezbollah's vulnerability as its communication network was compromised to deadly effect. Several areas of the country were affected, particularly Beirut's southern suburbs, a populous area that is a known Hezbollah stronghold. At least 9 people were killed, including a child, and about 2,800 people were wounded, overwhelming Lebanese hospitals.
Second Wave of Attack
As per the most recent reports, the next day, following the pager bombing incident, a second wave of blasts hit Beirut and multiple parts of Lebanon. Certain wireless devices such as walkie-talkies, solar equipment, and car batteries exploded, resulting in at least 9 people killed and 300 injured, according to the Lebanese Health Ministry. The attack is said to have embarrassed Hezbollah, incapacitated many of its members, and raised fears about a greater escalation of hostilities between the Iran-backed Lebanese armed group and Israel.
A New Kind of Threat - ‘Cyber-Physical’ Attacks
The incident raises serious concerns about physical tampering with daily-use electronic devices and the possibility of triggering a new age of warfare. This highlights the serious physical threat posed, wherein even devices such as smartwatches, earbuds, and pacemakers could be vulnerable to physical tampering if an attacker gains physical access to them. We are potentially looking at a new age of ‘cyber-physical’ threats where the boundaries between the digital and the physical are blurring rapidly. It raises questions about unauthorised access and manipulation targeting the physical security of such electronic devices. There is a cause for concern regarding the global supply chain across sectors, if even seemingly-innocuous devices can be weaponised to such devastating effect. Such kinds of attacks are capable of causing significant disruption and casualties, as demonstrated by pager bombings in Lebanon, which resulted in numerous deaths and injuries. It also raises questions on the regulatory mechanism and oversights checks at every stage of the electronic device lifecycle, from component manufacturing to the final assembly and shipment or supply. This is a grave issue because embedding explosives and doing malicious modifications by adversaries can turn such electronic devices into weapons.
CyberPeace Outlook
The pager bombing attack demonstrates a new era of threats in warfare tactics, revealing the advanced coordination and technical capabilities of adversaries where they have weaponised the daily use of electronic devices. They have targeted the hardware security of electronic devices, presenting a serious new threat to hardware security. The threat is grave, and has understandably raised widespread apprehension globally. Such kind of gross weaponisation of daily-use devices, specially in the conflict context, also triggers concerns about the violation of International Humanitarian Law principles. It also raises serious questions on the liabilities of companies, suppliers and manufacturers of such devices, who are subject to regulatory checks and ensuring the authenticity of their products.
The incident highlights the need for a more robust regulatory landscape, with stricter supply chain regulations as we adjust to the realities of a possible new era of weaponisation and conflict expression. CyberPeace recommends the incorporation of stringent tracking and vetting processes in product supply chains, along with the strengthening of international cooperation mechanisms to ensure compliance with protocols regarding the responsible use of technology. These will go a long way towards establishing peace in the global cyberspace and restore trust and safety with regards to everyday technologies.
References:
1. https://indianexpress.com/article/what-is/what-is-a-pager-9573113/
5. https://www.theguardian.com/world/2024/sep/18/hezbollah-pager-explosion-lebanon-israel-gold-apollo
WhatsApp messages masquerading as an offer from Maruti Suzuki with links luring unsuspecting users with the promise of Maruti Suzuki 40th Anniversary Celebration presents, have been making the rounds on the app. If you receive such messages try to stay away from it, as it can be a scam.
The Research Wing of CyberPeace Foundation along with Autobot Infosec Private Limited have conducted a study based on a WhatsApp message that contained a link pretending to be a free gift offer from Maruti Suzuki which asks users to participate in a survey in order to get a chance to win a Maruti Baleno Sigma MT car.
Warning SignsThe campaign pretends to be an offer from Maruti Suzuki but is hosted on a third party domain instead of the official Maruti Suzuki website which makes it more suspicious.
The domain names associated with the campaign have been registered in very recent times.
Multiple redirections have been noticed between the links.
No reputed site would ask its users to share the campaign on WhatsApp.
The prize is kept really attractive to lure the laymen.
Grammatical mistakes have been noticed.
A congratulations message appears on the landing page with an attractive photo of Maruti Suzuki cars that asks users to participate in a quick survey in order to get a “Maruti Suzuki BALENO Sigma MT”. Also, the bottom of the page seems to appear like a comment section with public comments establishing the truthfulness of the offer.
The survey starts with some basic questions like Do you know Maruti Suzuki?, How old are you?, How do you think of Maruti Suzuki?, Are you male or female? Etc. Once the user answers the questions a “congratulatory message” is displayed.
On clicking the OK button users are given three attempts to win the prize. After completing all the attempts a message pops up that the user has won “Maruti Suzuki BALENO Sigma MT”. It then prompts the user to share the message on WhatsApp.
Strangely enough the user has to keep clicking the WhatsApp button until the progress bar completes. After clicking on the green ‘WhatsApp’ button multiple times it shows a section where an instruction has been given to complete registration in order to get the prize.
After clicking on the green ‘Complete registration’ button, it redirects the user to multiple advertisements web pages varying each time the user clicks on the button.
During the analysis the research team found a javascript code called hm.js was being executed in the background from the host hm[.]baidu[.]com which is a subdomain of Baidu and is used for Baidu Analytics, also known as Baidu Tongji. The important part is that Baidu is a Chinese multinational technology company specializing in Internet-related services, products and artificial intelligence, headquartered in Beijing’s Haidian district, China.To read the full report, please click (https://www.cyberpeace.org/CyberPeace/Repository/20210828Research-report-on-Maruti-Suzuki-40th-Anniversary-Celebration-free-gift-scam.pdf) here:
Conclusive Summary
1. The whole research activity was performed in a secured sandbox environment where the WhatsApp application was not installed. If any user opens the link from a device like smartphones where the WhatsApp application is installed, the sharing features on the site will open the Whatsapp application on the device to share the link.
2. The campaign collects browser and system information from the users.
3. Most of the domain names associated with the campaign have the registrant country as China.
4. Cybercriminals used Cloudflare technologies to mask the real IP addresses of the front-end domain names used in this Maruti Suzuki 40th Anniversary Celebration free gift campaign. But during the phases of investigation, the research team has identified a domain name that was requested in the background and has been traced as belonging to China.
CyberPeace Advisory
1. CyberPeace Foundation and Autobot Infosec recommend that people should avoid opening such messages sent via social platforms.
2. If at all, the user gets into this trap, it could lead to whole system compromise such as access to the microphone, Camera, Text Messages, Contacts, Pictures, Videos, Banking Applications, etc as well as financial losses.
3. Do not share confidential details like login credentials, banking information with such a type of scam.
4. Do not share or forward fake messages containing links without proper verification.
5. There is a need for International Cyber Cooperation between countries to bust the cybercriminal gangs running the fraud campaigns affecting individuals and organizations, to make Cyberspace resilient and peaceful.
Executive Summary:
Amid the ongoing war involving the United States, Israel, and Iran, a video clip circulating on social media claims to show Iran unveiling a drone resembling the US B-2 stealth bomber. In the viral clip, an aircraft-like object can be seen emerging from a cave before taking off. Several users are sharing the video with the claim that Iran has deployed a B-2-style drone in the conflict.
However, research by the CyberPeace found that the viral video is not real and was generated using artificial intelligence. While the United States has reportedly used B-2 stealth bombers in strikes against Iran during the conflict, the viral clip does not show an actual Iranian drone.
Claim
X user “Muslim_Voice_Space” posted the video on March 3, 2026, claiming that Iran had rolled out a drone resembling the B-2 bomber for use in the war.
Fact Check
To verify the claim, we first closely examined the viral video. In the opening moments of the clip, the wing of the alleged drone appears to hit the side of the cave while exiting. Despite the apparent collision, the aircraft continues flying smoothly without any visible damage. This unusual detail raised doubts about the authenticity of the footage.
We then analyzed the video using the AI detection tool Hive Moderation, which flagged the clip as likely AI-generated.
Further analysis using the Sightengine AI detection tool also suggested that the video was artificially created. The tool estimated a 75% probability that the footage was generated using AI. It also indicated a 70% likelihood that the clip may have been created using Sora, an AI video-generation tool.
Conclusion
The viral video claiming to show an Iranian drone resembling the US B-2 stealth bomber emerging from a cave is not authentic. Analysis indicates that the clip was created using AI tools and is being misleadingly shared in the context of the ongoing conflict.
