#FactCheck- AI-Generated Video Falsely Claims Iran Shot Down US F-35 Fighter Jet

BharOS’s successful testing grabbed massive online attention after Ashwini Vaishnaw, Minister of Communications and Electronics & IT, and Union Education Minister Dharmendra Pradhan unveiled the new mobile operating system. On Data Privacy Day, January 28, it’s appropriate to discuss the safety factors.

The OS is developed by JandKops, which has been incubated by IIT Madras Pravartak Technologies Foundation. It is claimed that BharOS will ensure the prevention of the “execution of any malware” and “execution of any malicious application”.

Even though it is called a Made in India OS, there are many people who disagree with this. It is because the OS is based on an AOSP (Android Open Source Project). It includes similar methodologies, functionalities, and basics used in Google Android.

Global safety factor

Security and data safety has been worldwide issue. A few years ago, Alphabet CEO Sundar Pichai also testified in front of US Congress while facing questions related to privacy, data collection, and location tracking.

While experts say that Android’s app ecosystem is a privacy and security disaster, a study that examined 82,501 apps pre-installed on 1,742 Android smartphones sold by 214 vendors concluded that users are woefully unaware of the significant security and privacy risks posed by pre-installed applications.

Even Apple, which takes cybersafety issues as a top priority, sometimes finds itself in a vulnerable situation. For example, last year Apple users were advised to update their devices to protect against a pair of security flaws that could allow attackers to take complete control.

It was said that one of the software flaws affected the kernel, the deepest layer of the OS shared by all Apple devices, while the other had an impact on WebKit, the technology that powers the Safari web browser.

Security researchers, including NordVPN, said that Apple’s closed development OS makes it more difficult for hackers to develop exploits, while Android raises the threat level since anyone can see its source code to develop exploits.

BharOS is not like iOS but it is kind of similar to Android and based on AOSP. So the question is, how safe would this OS be?

‘Security blanket’

Sandip Kumar Panda, Co-founder and CEO of InstaSafe, told News18: “BharOS acts as a security blanket for devices. The framework is designed in a manner that it prevents the execution of any malicious app and verifies each app on the devices before making it live on the BharOS platform.”

There are no apps without any vulnerabilities, he said. “As the app development progresses, vulnerabilities get introduced either in the form of insecure coding practices or third-party software vulnerabilities integrated with the platform. Since several Android vulnerabilities were discovered over the years, all those bugs would have been fixed now and updates would already have been for AOSP, which will be much more mature now,” he added.

Vineet Kumar, Founder and President of CyberPeace Foundation, believes that “the use of AOSP as the foundation for BharOS is a positive step” as it is a robust platform.

But according to him, it is important to note that no OS can be completely immune to all forms of cyber threats. “The key to staying safe online is to stay vigilant, use security software, keep your software updated, and be mindful of the apps you install and the websites you visit,” he said,

Furthermore, the expert stated that it is possible to make an OS more secure by implementing a variety of security features and technologies such as sandboxing, whitelisting, and application control, as well as rigorous testing and code review processes.

Kumar said: “It would be important for an independent, reputable security firm to evaluate BharOS and test its security features before it can be stated with certainty that it is more secure than other OSs.”

It is difficult to say whether the BharOS will be free of cybersecurity issues without more information about the specific features and security measures that have been implemented, he noted while adding that this OS has to go through a rigorous testing and certification process.

“It will be important to see how it measures up against established security standards and how well it can withstand real-world attacks,” the expert stated.

‍

Reference Link : https://www.news18.com/amp/news/tech/data-privacy-day-how-safe-is-bharos-what-do-cybersecurity-experts-say-you-are-about-to-find-out-6932521.html

Introduction

‍

We inhabit an era where digital connectivity, while empowering, has also unleashed a relentless tide of cyber vulnerabilities, where personal privacy is constantly threatened, and crimes like sextortion are the perfect example of the sinister side of our hyperconnected world. Social media platforms, instant messaging apps, and digital content-sharing tools have all grown rapidly, changing how people communicate with one another and making it harder to distinguish between the private and public domains. The rise of sophisticated cybercrimes that use the very tools meant to connect us is the price paid for this unparalleled convenience. Sextortion, a portmanteau of “sex’ and “extortion”, stands out among them as a particularly pernicious kind of internet exploitation. Under the threat of disclosing their private information, photos, or videos, people are forced to engage in sexual behaviours or provide intimate content. Sextortion’s psychological component is what makes it particularly harmful, it feeds on social stigma, shame, and fear, which discourage victims from reporting the crime and feed the cycle of victimisation and silence. This cybercrime targets vulnerable people from all socioeconomic backgrounds and is not limited by age, gender, or location. 

‍

The Economy of Shame: Sextortion as a Cybercrime Industry

‍

A news report from June 03, 2025, reveals a sextortion racket busted in Delhi, where a money trail of over Rs. 5 crore was identified by different teams of the Crime branch. From synthetic financial identities to sextortion and other cyber frauds, a recipe for a sophisticated cybercrime chain was found. To believe this is an aberration is to overlook the reality that it is symptomatic of a much wider and largely uncharted criminal framework. According to the FBI’s 2024 IC3 report, “extortion (including sextortion)” has skyrocketed to 86,415 complaints with losses of $143 million reported in the United States (US) alone. This indicates that coercive image-based threats are no longer an isolated cybercrime but an everyday occurrence. Sextortion is no longer an isolated cybercrime; it has metamorphosed into a systematic, industrialised criminal enterprise. Another news report dated 19th July, 2025, where Delhi Police has detained four people suspected of participating in a sextortion scheme that targeted a resident of the Bhagwanpur Khera neighbourhood of Shahdara. The suspected people were allegedly arrested on a complaint wherein the victim was manipulated and fell prey to a dating site. 

The threat is amplified by the usage of deepfake technology, which allows offenders to create obscene content that looks believable. The approach, which relies on the stigma attached to sexual imagery in conservative societies like India, is that victims frequently give in to requests out of fear of damaging their reputations. The combination of cybercrime and cutting-edge technology highlights the lopsided power that criminals possess, leaving victims defenceless and law enforcement unable to keep up. 

‍

Legal Remedies and the Evolving Battle Against Sextortion

‍

Given the complexity of these crimes, India has recognised sextortion and similar cyber-enabled financial crimes under a number of legal frameworks. A change to recognising cyber-enabled sexual exploitation as an organised criminal business is shown by the introduction of specific provisions like Section 111 in the Bhartiya Nyaya Sanhita (BNS), 2023, which classifies organised cybercrimes including extortion and frauds which fall under its expansive interpretation, as a serious offence. Similarly, Section 318 (2) criminalises cheating with a maximum sentence of three years in prison or a fine, whereas Section 336 (2) makes digital forgery a crime with a maximum sentence with a maximum sentence of two years in prison or a fine. In addition to these regulations, cheating by personation through computer resources is punishable by the Information Technology Act, 2000, specifically Section 66D, which carries a maximum sentence of three years in prison and a maximum fine of Rs. 1 lakh. Due to issues with attribution, cross-border jurisdiction, and the discreet nature of digital evidence, enforcement is still inconsistent even with current statutory restrictions. 

The government and its agencies recognise that laws achieve real impact only when backed by awareness initiatives and accessible, localised mechanisms for redressal. Several Indian states and the Department of Telecommunications launched numerous campaigns to educate the public about and safeguard their mobile communication assets against identity theft, financial fraud, and cyberscams. Initiatives like Cyber Saathi Initiative and Cyber Dost by MHA, with the goal of improving forensic and victim reporting skills.

‍

Conclusion

‍

At CyberPeace, we understand that the best defence against online abuse is prevention. Our goal is to provide people with the information and resources to identify, avoid and report sextortion attempts like CyberPeace Helpline and organise awareness campaigns on safe digital habits. In order to remain updated with the constantly looming danger, our research and policy advocacy also focus on developing more robust legal and technological safeguards. 

To every reader: think before you share, secure your accounts, and never let shame silence you. If you or someone you know becomes a victim, report it immediately, help is available, and justice is possible. Together we can reclaim the internet as a space of trust, not terror. 

‍

References 

‍

• https://www.hindustantimes.com/india-news/delhi-police-busts-sextortion-cyberfraud-rackets-6-held-101748959601825.html 
• https://timesofindia.indiatimes.com/city/delhi/delhi-police-arrests-four-for-sextortion-and-blackmail-in-shahdara/articleshow/122767656.cms ‍
• https://cdn.ncw.gov.in/wp-content/uploads/2025/05/CyberSaheli.pdf

Perth, Western Australia — For most of the past year, the name TeamPCP has circulated quietly within cybersecurity circles as shorthand for a particular kind of dread: not the dread of a phishing email or a suspicious link, but the dread of software you already trusted turning against you. This week, that quiet circulation became public record. The Australian Federal Police, working alongside the FBI and the Western Australia Police Force, arrested and charged two Western Australian men, aged 21 and 23, with a combined 14 offences over their alleged role in the group.

The arrests themselves are notable. The story behind them is more so.

A Campaign Built on Borrowed Trust

TeamPCP's alleged method was not to break down the front door. It was to compromise the door itself, the trusted mechanisms by which developers pull code into their own projects every day. The group has been linked to widespread supply-chain attacks that targeted open-source software and developer platforms to steal credentials, authentication secrets, and source code, with high-profile incidents affecting projects including Trivy, LiteLLM, Telnyx, SAP, and TanStack, alongside breaches at organisations such as the European Commission, Mistral AI, OpenAI, and GitHub. Reporting has also linked the campaign to ecosystems including GitHub Actions, Docker Hub, npm, PyPI and OpenVSX, the invisible plumbing through which most modern software is assembled.

The scale, as alleged by investigators, is difficult to overstate. Authorities say the malicious code potentially compromised over a thousand organisations worldwide, enabling the theft of roughly half a million credentials and the exfiltration of at least 300GB of data, figures that should be understood as allegations under active investigation rather than an independently verified victim count. The AFP itself has said the compromise of a small number of trusted software components had a significant global impact, with remediation costs estimated in the hundreds of millions of dollars.

Why This Attack Was So Hard to See Coming

The mechanics matter. Rather than tricking a user into clicking something malicious, the alleged operation worked by compromising the credentials developers use to publish legitimate software updates, then pushing tampered versions out through the same trusted distribution pipelines millions of applications rely on automatically. There is no obviously suspicious file, no rogue website, only a routine update, arriving exactly where it was expected.

Investigators also describe a cascading structure to the intrusions: credentials harvested from one compromised project reportedly opened the door to the next, turning isolated breaches into a chain reaction across the open-source ecosystem. TeamPCP has been described as running one of the most consequential campaigns of software supply-chain attacks investigators have tracked, and the group's reach extended notably into the AI stack — LiteLLM, one of the projects reportedly compromised, is an open-source gateway widely used to connect applications to large language model providers, meaning the attack's blast radius extended into the very infrastructure powering today's AI boom.

The Investigation and the Charges

The two men were charged following a joint investigation by the AFP and WAPF, working in parallel with the FBI, into what authorities describe as a sophisticated cybercrime syndicate accused of creating malicious open-source software to defraud thousands of global businesses. The charges span identity theft, unauthorised data modification, and money laundering, with maximum penalties ranging from three to twenty years' imprisonment. Search warrants were executed in Perth on 26 August 2026, and investigators seized electronic devices for forensic analysis after raids at properties in Cottesloe, Hamilton Hill, and Mandurah. FBI Cyber Division Assistant Director Brett Leatherman noted the significance of the international cooperation involved in the case, while investigators have not ruled out further arrests.

The Real Story: A Governance Problem, Not Just a Crime Story

It would be easy to file this under "hackers caught" and move on. But the more consequential story is structural. Modern organisations do not merely secure their own infrastructure, they inherit risk from every library, package, CI/CD pipeline, repository, vendor and developer tool they depend on, often without ever auditing that dependency chain directly. Guidance from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) on securing open-source software has increasingly emphasised managing these dependencies through software bills of materials (SBOMs), precisely because so few organisations can otherwise answer a basic question: what, exactly, is running inside our systems?

TeamPCP's alleged campaign is a case study in why that question can no longer be optional. If an organisation's security posture is only as strong as the thousands of components it silently trusts, then supply-chain security is not a developer problem to be quietly patched — it is a governance issue, deserving board-level attention, vendor accountability frameworks, and mandatory disclosure practices.

CyberPeace's Take

At CyberPeace, we've been watching campaigns like TeamPCP's less as isolated incidents and more as a pattern that keeps repeating with higher stakes each time. What stands out to our team isn't the sophistication of the code, open-source poisoning is, frankly, not a new technique, it's the sophistication of patience. Compromising a maintainer's publishing credentials and simply waiting for the next scheduled release to carry the payload downstream is a strategy built for an ecosystem that still largely operates on implicit trust rather than continuous verification. That gap between how fast software moves and how slowly trust is actually checked is precisely where operations like this thrive.

We'd also push back gently on treating this as a "developer hygiene" story. Most engineering teams pulling in a package from npm or PyPI are not, and should not be expected to be, forensically auditing every dependency update by hand, that isn't scalable, and it was never a realistic line of defence. The actual fix has to sit further upstream: provenance verification baked into CI/CD pipelines, signed commits and releases treated as non-negotiable rather than optional, and SBOMs that are actually queried during incident response rather than generated once and filed away.

Our broader concern, honestly, is about incentive alignment. Open-source maintainers are frequently unpaid or under-resourced volunteers holding publishing keys to software depended on by billion-dollar enterprises. Until organisations that consume open-source software at scale start meaningfully funding its security, not just its development,  this pattern isn't going away. It will simply find its next entry point.

References

• Australian Federal Police. Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate. afp.gov.au
• Bleeping Computer. Australia arrests alleged TeamPCP hackers behind supply-chain attacks. bleepingcomputer.com
• CyberScoop. Two alleged TeamPCP members arrested and charged after months of software supply-chain chaos. cyberscoop.com
• Cyber Daily. Busted! Alleged Aussie hackers linked to TeamPCP arrested in joint AFP-FBI-WAPF operation. cyberdaily.au
• Help Net Security. Two alleged TeamPCP hackers arrested over global supply chain attacks. helpnetsecurity.com
• Krebs on Security. Two Alleged 'TeamPCP' Hackers Arrested in Australia. krebsonsecurity.com
• TechCrunch. Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others. techcrunch.com
• The Hacker News. Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks. thehackernews.com

‍