Mumbai Police arrested an Indore graphic designer accused of supplying malicious APKs to cybercrime rings. The software allegedly enabled fraudsters to steal nearly Rs 150 crore from thousands nationwide.
Police said graphic designer Pankaj Gupta, who knew coding, created malicious applications disguised as popular government and utility services. (Image for representation)
Mumbai,Oct 15, 2026 16:26 IST
A 36-year-old graphic designer who once narrowly escaped a digital arrest scam allegedly went on to create malicious software that helped cyber fraudsters cheat more than 9,600 people across India of nearly Rs 150 crore, news agency Press Trust of India reported, citing police.
The Mumbai Crime Branch's Property Cell arrested Indore resident Pankaj Gupta for allegedly creating and supplying 2,805 malicious Android application files to cybercrime networks operating from Bihar and Jharkhand.
"Five years ago, Gupta narrowly escaped a digital arrest scam. Instead of staying away, he spotted a business opportunity and reached out to fraudsters, offering them custom-built APK files that act as digital ‘remote controls’ to compromise target smartphones," a senior police officer told PTI.
An APK, or Android Package Kit, is a file used to install an application on an Android device. A malicious APK is a fake or infected application designed to steal sensitive data, intercept one-time passwords or remotely control a mobile phone.
Police said Gupta, who knew coding, created malicious applications disguised as popular government and utility services. These included senior citizen card verification, e-traffic challans, pension verification, credit card updates and PM Kisan Yojana portals.
The investigation began after a senior citizen from Mumbai's Byculla area filed a complaint on August 13, alleging that he had been cheated.
“The victim received a call from an individual posing as a nationalised bank representative offering assistance with a Senior Citizen Card scheme. Upon clicking an APK link sent via text, Rs 5.62 lakh was fraudulently debited from his account,” the officer told PTI.
A technical analysis by the Mumbai Crime Branch led investigators to Gupta in Indore. Police said he rented servers from several companies to store the data collected through the malicious applications and sold each file to local calling groups for Rs 20,000 to Rs 25,000.
"The cyber rings contacted victims using leaked data from banks and institutions. The syndicate has targeted 9,673 individuals across India, with 1,074 complaints registered on the national cyber portal ‘130’, including 142 in Maharashtra and 36 in Mumbai alone," the officer told PTI.
Police said the victims were collectively cheated of nearly Rs 150 crore with the help of the malicious software allegedly created by Gupta. Further investigation into the network and those operating at the local level is underway.
The case centres on Gupta's alleged supply of 2,805 malicious Android files to cybercrime networks, which police say used them to target 9,673 people and defraud victims of nearly Rs 150 crore across India.
- Ends