An 18-year-old Class 11 dropout has been arrested as the alleged mastermind behind a sophisticated nationwide cyber fraud network that used artificial intelligence tools and Telegram to create and distribute malicious mobile applications, enabling cybercriminals to siphon more than Rs 64 crore from victims across India.
Surat City Cyber Crime Cell officers arrested Rohit Virendrasinh Shakya from a hotel in Kanpur, Uttar Pradesh. Police allege that Shakya developed and supplied fake banking and government APK files to organised cybercrime gangs operating primarily out of Jamtara in Jharkhand, as well as networks in Haryana and Rajasthan.
Despite leaving formal education after Class 11, investigators say Shakya had become a highly skilled coder by the age of 16. He reportedly used AI tools combined with Telegram channels to design malicious applications that closely mimicked legitimate banking, government and private-sector apps. He is alleged to have operated on a subscription model, charging cybercriminals Rs 15,000 per month for customised malware that included ongoing updates and technical support.
According to the investigation, Shakya created two distinct sets of applications. The “victim app” was designed to be installed by unsuspecting users on their own phones. Once installed, it allowed remote access. The corresponding “admin app” gave fraudsters real-time control to extract one-time passwords, banking credentials and other sensitive information.
The fake applications impersonated a wide range of trusted institutions and services, including the State Bank of India, Punjab National Bank, Axis Bank, UCO Bank, ICICI Bank, Union Bank, BigBasket, American Express, Aadhaar-related services, the PM Kisan portal and RTO challan payment systems.
The case came to light after a Surat resident reported losing Rs 5 lakh in a cyber fraud in May 2026. Between 15 and 18 May, the victim received a file labelled “PNB One.apk” via WhatsApp. Believing it to be the official Punjab National Bank application, he installed it. His device was immediately compromised, allowing criminals to transfer Rs 5 lakh from his account at Prime Co-operative Bank to a Union Bank account. The victim contacted the national cyber helpline 1930, prompting Surat Cyber Crime to register an FIR and begin a detailed probe.
Digital forensic analysis later revealed the scale of the operation. Shakya is alleged to have developed 121 malicious APK applications that were installed on 21,672 mobile phones across the country. Of these, 2,928 devices were fully compromised, resulting in 54,094 fraudulent banking transactions totalling approximately Rs 64.38 crore. Fake RTO challan applications accounted for the highest number of individual frauds, followed by counterfeit SBI and PNB apps.
The malicious files were distributed through Telegram to organised syndicates under the monthly subscription arrangement. Surat Police have seized two mobile phones and a laptop from Shakya and have begun an extensive digital forensic examination. Investigators are now examining whether additional cybercrime networks across India were using his software and whether further accused persons were involved in the broader ecosystem.
