#FactCheck : Old images of US sailors falsely linked to ongoing Iran tensions

Introduction

On 14 October 2026, ANI reported that the Sashastra Seema Bal (SSB), the force responsible for guarding India’s borders with Nepal and Bhutan, had directed its personnel not to fall for online honey traps, open suspicious APK files, or become victims of cyber scams. The warning was issued a day after the force’s annual cybersecurity awareness week and is relevant to every smartphone user in India. The three threats highlighted in the advisory, emotional exploitation, malware disguised as APK files, and financial scams, are often interconnected in a cyberattack chain that can compromise a person’s device or finances. This blog examines the advisory, the methods used by cybercriminals, and the everyday precautions users can take to stay safe.

What the Advisory Says

As per the ANI report, the SSB has cautioned its personnel about talking to strangers on the internet, where they have been instructed not to share photos or videos with anyone in the public eye, accept suspicious calls or video calls, or entertain requests for money, and not to install APKs or applications from any untrusted sources or websites, only use an authorised Android market to install applications, not to share your OTP, PIN, password, or banking details, and to be cautious while receiving an unknown call, suspicious SMS, or click on unknown links and scan QR codes. Personnel have been told not to tell something that does not seem right, and any fraud should be reported through cybercrime helpline number 1930 or cybercrime.gov.in. "Always verify before any transaction" & "Stop, think, check, then act." The SSB caution has been read.

How Online Honey Traps Operate

A honey trap, by definition, is a trap set through the manipulation of a fictitious romantic or social identity designed to gain trust, which is then used against it. There are certain elements that almost always constitute the honey trap.

1. Contact: A fake profile, typically an attractive picture, reaches out to the targeted person on social media or a messaging platform.
2. Rapport: Created via a mix of small talk, flattery, and "shares" or "interests."
3. Escalation: The chatting advances to private messaging, involving sharing of photos or video.
4. Extortion: The victim is subsequently threatened with blackmail through recordings, forced to make payments, or extorted for personal information.

This is not an isolated case. Earlier, the Delhi Police had revealed that fake Facebook female profiles were used to lure and befriend defence personnel and extract confidential information (The Quint). Even more recently, a case was reported of an IAF wing commander being lured on social media while undergoing troubled times and, thereafter, made to reveal sensitive defence-related information (Outlook India). While the matter is sub judice, it draws our attention towards an important point of analytical significance – most probably it is emotional trauma, which an attacker would rely upon, rather than technical and security flaws.

The Risk of Malicious APK Files

APK – Android Package Kit, is the package file format used by the Android operating system for the distribution and installation of mobile applications. Downloaded from Play Store, the application goes through a rigorous screening. However, those downloaded from WhatsApp, Telegram or SMS have not been screened. This is the modus operandi of the cybercriminals. They hide malware behind seemingly harmless files like a challan, a gas bill update, a KYC or a wedding invite. Proof from Moneylife pointing to an alert issued by CERT-In as well as file names like RTO Challan.apk and Gas Bill Update.apk establishes that government departments would not send an APK file over any messaging platform.

According to the CERT-In research of India's cybersecurity agency, the way this malware works: The malware Drinik posed as a download application from the Income Tax Department and asked for a long list of admin permissions, including SMS, call history, and contacts. It then presented a fake banking app to steal credentials, as Madhyamam reports. The Tribune reported that the SOVA trojan was hidden in fake apps with famous brands' logos. The report also states that the Black Rock malware variant was targeting 337 applications, including social, communication, and dating applications.

A security advisory by the bank, dated 24 November 2023, mentions what happens if a virus-infected app is installed. Once installed, the attackers would be able to access the messages with the one-time passwords (OTPs) and personal identification numbers (PINs). They could take over the device and make money transactions from the bank account of the owner of the device, says the advisory.

Social Engineering: The Common Thread

Although honey traps and APK frauds may appear on the surface to be very different, there is one aspect they have in common: both are social engineering tricks. The attacker does not rely solely on technological control or access control but also on human vulnerabilities – the fear, intimidation, lust, or love – to persuade the target to behave in a certain manner. The "opposite" sex may ask you to install some "video call app", or a "bank officer" may advise you to update KYC via a file that you may or may not be having. In any of these instances, it is the final step that you will likely carry out without hesitation. The SSB's four steps (stop, think, check, then act) provide a mechanism to break this cycle.

Implications for Personal, Financial and National Security

A phone on the compromised list reveals contacts, snaps, messages and location. Honey trap nudity can take a toll on a person's mental health and reputation via sextortion.
Financial security- Since malware can read SMS, OTP-based protection works quietly. The fraudster can authorise the transaction without the victim providing a code.
National security – For service members, it's not just their personal information at risk. A compromised device can disclose information about their location and their colleagues or how they operate. Border forces operate in a high-risk environment, and no information is too small; even duty rosters or images taken against a landmark background could be of interest to a hostile person, and honey trap recruitment for spy work is one of the oldest.

Practical Precautions

• Avoid sideloading APKs at all costs. Sideloading APKs is highly discouraged. It is best to keep the "Install from unknown sources" option turned off and install apps only from the Google Play Store or the Apple App Store.
• Whenever you have an unsolicited contact, it is not worth believing. It is believed that reversing the search of profile images and being very careful with new acquaintances who quickly begin chatting in private is protective. Never comply with any requests for money.
• Sharing intimate images or receiving surprise video calls from unknown people should be avoided.
• Storing credentials is especially sensitive. Research has shown that a legitimate bank or government body would not typically ask for details like OTPs, PINs or passwords.
• Scrutinise app permissions. Beware of a seemingly simple app requesting permission to access SMS, call logs or contacts.
• It should be verified from an official source. Challans, KYC or taxes are to be submitted using the official website or app and not the link provided in the message.
• It is important to keep professional and personal lives separate. Do not discuss comments, movements or chores or post location-tagged updates.
• Keeping your devices updated and turning on Google Play Protect are crucial.
• In case you are a victim, do take quick actions. Remove the suspicious app, disconnect from the web, and inform your bank. You can report to 1930 or cybercrime.gov.in. Do not pass the suspicious file as it is going to pass on the same.

Conclusion

The SSB advisory today is a reminder that cyberattacks are less about technology and more about exploiting human vulnerabilities. Studies indicate that fake ID cards, realistic files and misinformation are easy to implement and hard to detect. It appears that cultivating verification routines, instilling a "careful hygiene of use", and quick reporting on 1930 or cybercrime.gov.in are the best initiatives that border forces and citizens can take. Creating awareness about pausing, analysing, verifying and acting if in doubt could be an even better way of building resilience. It is crucial for everyone to remain cognisant and alert and keep cyber safety at the top of the mind.

‍

Executive Summary
‍

Several social media posts are claiming that Chinese troops have entered nearly 60 kilometres inside Arunachal Pradesh. Amid these claims, a video showing security personnel managing a large crowd is being widely circulated as footage from Arunachal Pradesh. Users are sharing the clip claiming it captures the situation following the alleged Chinese intrusion. CyberPeace Research Wing found the claim to be false. The viral video is not from Arunachal Pradesh. It actually shows Baltal Base Camp during the Amarnath Yatra in Jammu and Kashmir. The Government of India has also categorically denied reports of any recent Chinese intrusion into Indian territory.

‍

Claim

‍

A Facebook user, "Komal Vanshi," shared the video on July 8, 2026, claiming that Chinese People's Liberation Army (PLA) soldiers had entered deep inside Arunachal Pradesh and referring to alleged incidents along the Line of Actual Control (LAC). The post was accompanied by the viral video, suggesting it was related to the alleged intrusion.

https://www.facebook.com/reel/1585091393251089 

https://perma.cc/9D3L-HDMW 

Fact Check

‍

We first carefully examined the viral video. During the analysis, we noticed barricades bearing the words "Jammu & Kashmir Police." This clearly indicated that the footage could not have been recorded in Arunachal Pradesh.

‍

‍

In the next step, we extracted multiple keyframes from the video and conducted a reverse image search using Google Lens. Although the video was widely shared with the Arunachal Pradesh claim, our search led us to a YouTube Shorts video uploaded on July 7, 2026, identifying the location as Baltal, one of the main base camps for the annual Amarnath Yatra in Jammu and Kashmir.

https://www.youtube.com/watch?v=EEfP2RckyJM

The visual details in the YouTube video matched the viral footage, confirming that it was filmed at Baltal Base Camp and had no connection with Arunachal Pradesh or any alleged Chinese military movement 

‍

Conclusion

‍

CyberPeace Research Wing found that the viral claim is false. The video being circulated as evidence of a Chinese military incursion into Arunachal Pradesh actually shows crowd management arrangements at Baltal Base Camp during the Amarnath Yatra in Jammu and Kashmir. The footage has been falsely linked to an unrelated claim about Chinese troops entering Indian territory. There is no evidence that the video depicts any incident related to the India-China border.

‍

Introduction 

‍

The digital landscape of the nation has reached a critical point in its evolution. The rapid adoption of technologies such as cloud computing, mobile payment systems, artificial intelligence, and smart infrastructure has led to a high degree of integration between digital systems and governance, commercial activity, and everyday life. As dependence on these systems continues to grow, a wide range of cyber threats has emerged that are complex, multi-layered, and closely interconnected. By 2026, cyber security threats directed at India are expected to include an increasing number of targeted, well-organised, and strategic cyber attacks. These attacks are likely to focus on exploiting the trust placed in technology, institutions, automation, and the fast pace of technological change.

‍

1. Social Engineering 2.0: Hyper-Personalised AI Phishing & Mobile Banking Malware

‍

Cybercriminals have moved from generalised methods to hyper-targeted attacks through AI-based psychological manipulation. In addition to social media profiles, data breaches, and digital/tracking footprints, the latest types of cybercrimes expected in 2026 will involve AI-based analysis of this information to create and increase the use of hyper-targeted phishing emails.

Phishing emails are capable of impersonating banks, employers, and even family members, with all the same regionally or culturally relevant tone, language, and context as would be done if these persons were sending the emails in person.

With malicious applications disguised as legitimate service apps, cybercriminals have the ability to intercept and capture One-Time Passwords (OTPs), hijack user sessions, and steal money from user accounts in a matter of minutes.

These types of attempts or attacks are successful not only because of their technical sophistication, but because they take advantage of human trust at scale, giving them an almost limitless reach into the financial systems of people around the world through their computers and mobile devices.

‍

2. Cloud and Supply Chain Vulnerabilities

‍

As Indian organisations increasingly migrate to cloud infrastructure, cloud misconfigurations are emerging as a major cybersecurity risk. Weak identity controls, exposed storage, and improper access management can allow attackers to bypass traditional network defences. Alongside this, supply chain attacks are expected to intensify in 2026.

In supply chain attacks, cybercriminals compromise a trusted software vendor or service provider to infiltrate multiple downstream organisations. Even entities with strong internal security can be affected through third-party dependencies. For India’s startup ecosystem, government digital platforms, and IT service providers, this presents a systemic risk. Strengthening vendor risk management and visibility across digital supply chains will be essential.

‍

3. Threats to IoT and Critical Infrastructure

‍

By implementing smart cities, digital utilities, and connected public services, IoT has opened itself up to increased levels of operational technology (OT) through India’s initiative. However, there is currently a lack of adequate security in the form of strong authentication, encryption, and update methods available on many IoT devices. By the year 2026, attackers are going to be able to exploit these vulnerabilities much more than they already are.

Cyberattacks on critical infrastructure such as energy, transportation, healthcare, and telecom systems have far-reaching consequences that extend well beyond data loss; they directly affect the provision of essential services, can damage public safety, and raise concerns over national security. Effectively securing critical infrastructure needs to involve dedicated security solutions to deal with the specific needs of critical infrastructure, in contrast to conventional IT security.

‍

4. Hidden File Vectors and Stealth Payload Delivery

‍

SVG File Abuse in Stealth Attacks

‍

Cybercriminals are continually searching for ways to bypass security filters, and hidden file vectors are emerging as a preferred tactic. One such method involves the abuse of SVG (Scalable Vector Graphics) files. Although commonly perceived as harmless image files, SVGs can contain embedded scripts capable of executing malicious actions.

By 2026, SVG-based attacks are expected to be used in phishing emails, cloud file sharing, and messaging platforms. Because these files often bypass traditional antivirus and email security systems, they provide an effective stealth delivery mechanism. Indian organisations will need to rethink assumptions about “safe” file formats and strengthen deep content inspection capabilities.

‍

5. Quantum-Era Cyber Risks and “Harvest Now, Decrypt Later” Attacks

‍

Although practical quantum computers are still emerging, quantum-era cyber risks are already a present-day concern. Adversaries are believed to be intercepting and storing encrypted data now with the intention of decrypting it in the future once quantum capabilities mature—a strategy known as “harvest now, decrypt later.” This poses serious long-term confidentiality risks.

Recognising this threat, the United States took early action during the Biden administration through National Security Memorandum 10, which directed federal agencies to prepare for the transition to quantum-resistant cryptography. For India, similar foresight is essential, as sensitive government communications, financial data, health records, and intellectual property could otherwise be exposed retrospectively. Preparing for quantum-safe cryptography will therefore become a strategic priority in the coming years.

‍

6. AI Trust Manipulation and Model Exploitation

‍

Poisoning the Well – Direct Attacks on AI Models

‍

As artificial intelligence systems are increasingly used for decision-making—ranging from fraud detection and credit scoring to surveillance and cybersecurity—attackers are shifting focus from systems to models themselves. “Poisoning the well” refers to attacks that manipulate training data, feedback mechanisms, or input environments to distort AI outputs.

In the context of India's rapidly growing digital ecosystem, compromised AI models can result in biased decisions, false security alerts or denying legitimate services. The big problem with these types of attacks is they may occur without triggering conventional security measures. Transparency, integrity and continuous monitoring of AI systems will be key to creating and maintaining stakeholder confidence in the decision-making process of the automated systems.

‍

Recommendations

‍

Despite the increasing sophistication of malicious cyber actors, India is entering this phase with a growing level of preparedness and institutional capacity. The country has strengthened its cyber security posture through dedicated mechanisms and relevant agencies such as the Indian Cyber Crime Coordination Centre, which play a central role in coordination, threat response, and capacity building. At the same time, sustained collaboration among government bodies, non-governmental organisations, technology companies, and academic institutions has expanded cyber security awareness, skill development, and research. These collective efforts have improved detection capabilities, response readiness, and public resilience, placing India in a stronger position to manage emerging cyber threats and adapt to the evolving digital environment.

‍

Conclusion 

‍

By 2026, complexity, intelligence, and strategic intent will increasingly define cyber threats to the digital ecosystem. Cyber criminals are expected to use advanced methods of attack, including artificial intelligence assisted social engineering and the exploitation of cloud supply chain risks. As these threats evolve, adversaries may also experiment with quantum computing techniques and the manipulation of AI models to create new ways of influencing and disrupting digital systems. In response, the focus of cybersecurity is shifting from merely preventing breaches to actively protecting and restoring digital trust. While technical controls remain essential, they must be complemented by strong cybersecurity governance, adherence to regulatory standards, and sustained user education. As India continues its digital transformation, this period presents a valuable opportunity to invest proactively in cybersecurity resilience, enabling the country to safeguard citizens, institutions, and national interests with confidence in an increasingly complex and dynamic digital future.

‍

References

‍

1. https://www.seqrite.com/india-cyber-threat-report-2026/ 
2. https://www.uscsinstitute.org/cybersecurity-insights/blog/ai-powered-phishing-detection-and-prevention-strategies-for-2026
3. https://www.expresscomputer.in/guest-blogs/cloud-security-risks-that-should-guide-leadership-in-2026/130849/ 
4. https://www.hakunamatatatech.com/our-resources/blog/top-iot-challenges 
5. https://csrc.nist.gov/csrc/media/Presentations/2024/u-s-government-s-transition-to-pqc/images-media/presman-govt-transition-pqc2024.pdf
6. https://www.cyber.nj.gov/Home/Components/News/News/1721/214 

‍