Anganwadi Worker Loses ₹3.12 Lakh Raised from Land Sale to Malicious APK File

In a heartbreaking cyber extortion case that underscores the rising threat of remote device hacking across rural and semi-urban India, a 52-year-old Anganwadi worker from Chhattisgarh had her lifelong savings wiped out within days. To realize her dream of constructing a permanent family home, Sunita Nishad, employed at the Wako village Anganwadi center under the Khargaon police station limits in Mohla-Manpur-Ambagadh Chowki district, liquidated 75 decimals of her ancestral farmland to raise ₹3.12 lakh. After depositing the proceeds into her savings account to finance construction materials, her smartphone was silently compromised through a deceptive Android Package Kit (APK) file sent via WhatsApp. By the time the security breach was detected, cyber criminals had drained the entire sum through unauthorized digital payments, leaving a meager ₹1.75 in the account and shattering her construction plans.Silent Trojan Infiltration: How Malicious WhatsApp APK Files Seize Mobile Device ControlThe exploitation followed a sophisticated social engineering and malware deployment playbook:Inadvertent Malware Installation: Sunita frequently utilized WhatsApp to receive official departmental directives, circulars, and community updates; during these daily interactions, cyber fraudsters transmitted an unsolicited APK file masquerading as a routine document.Invisible Device Takeover: The malicious application installed quietly in the background without user consent, granting the hackers remote root access to intercept incoming SMS text messages, bypass two-factor authentications, and view stored personal data.Unauthorized Paytm UPI Generation Without Debit Card: Although the victim had never been issued an ATM debit card for her bank account, the perpetrators leveraged modern financial payment architecture—which allows establishing a Paytm UPI ID using identity card verification linked to the registered mobile number—to siphon funds between December 10 and December 14 without raising immediate suspicion.Suspicious Distress Messages Unmask Fraud: Account Emptied Down to ₹1.75The illicit financial drainage came to light only after the malware began automated outreach to the victim's contacts:Automated SOS Prompts: The victim's son, Mukund, grew suspicious after several relatives and acquaintances reported receiving urgent text messages sent directly from Sunita's personal number pleading for immediate financial transfers.Devastating Bank Balance Check: Alarmed by the unauthorized messaging activity, the family visited their local bank branch on January 10 to review transaction statements, discovering that the entire ₹3.12 lakh corpus had been siphoned off through sequential digital micro-transactions, leaving only ₹1.75.Formal Cyber Complaint: The family lodged an immediate complaint with the district cyber cell and Khargaon police station, prompting technical teams to track the virtual payment addresses and IP logs linked to the recipient digital wallets.Inter-State Gang Busted in Bengal: 176 Cases Across 14 States and 1.71 Lakh TransactionsA coordinated technical trace led law enforcement directly to an interstate cyber fraud network operating out of Eastern India:Tenth-Grade Classmates Behind Massive Syndicate: Police tracking teams raided hideouts in West Bengal, apprehending three key syndicate operatives, including Aditya Rajak and Krishna Chaudhary, two tenth-grade school friends who had built an extensive illicit digital footprint.Active Since 2023 with 176 Inter-State Charges: Interrogation records revealed that the syndicate had been systematically orchestrating remote banking frauds since 2023, with 176 criminal cases registered against them across 14 Indian states, including 31 active cases within the Mohla-Manpur jurisdiction alone.Staggering Scale of Illicit Operations: Forensic examination of the suspects' seized bank accounts and server registries documented over 1.71 lakh fraudulent transactions, prompting expanding investigations to recover stolen capital and neutralize associated rogue APK distribution networks.