The Surat Cyber Crime Branch in Gujarat has arrested an 18-year-old developer from Kanpur in Uttar Pradesh for allegedly creating fake banking applications and malware-laden APK files and providing them to cyber criminals across the country.
Investigators said that despite studying only up to class 11, the accused developed sophisticated tools using artificial intelligence and Telegram, which were allegedly used in large-scale cyber fraud operations.
The suspect arrested on Monday has been identified as Rohit Virendra Singh Shakya.
Police say he started creating malicious APK files when he was 16 years old using AI tools and Telegram. These applications can be used to compromise your phone and steal sensitive information.
During the investigation, police discovered that several cybercriminal syndicates based in Jharkhand’s Jamtara, as well as groups from Haryana and Rajasthan, are suspected of obtaining infected applications from him.
How did the network come to light?
The network came to light during investigation into a cyber fraud case registered in Surat. In May 2026, the victim received an APK file on WhatsApp that looked very similar to the official PNB One application of Punjab National Bank.
The victim downloaded and installed the app, believing it to be real. Soon after installation, the victim’s mobile phone was compromised and within minutes, Rs 500,000 was transferred from his Prime Cooperative Bank account to his Union Bank account.
Following the complaint, an investigation was initiated by the Surat Cyber Crime Investigation Department. The investigation ultimately led investigators to the alleged mastermind behind the operation.
A team of cyber crime investigators and IT experts raided a hotel in Kanpur and arrested the suspects. Police also seized his laptop, mobile phone and other digital devices.
During the interrogation, investigators discovered that the defendant was suspected of developing two types of applications. The first application was designed to be installed on the victim’s device, and the second application acted as a management application. According to reports, cybercriminals may be able to view OTPs, banking details, and other sensitive information from the victim’s mobile phone in real-time through the management app.
The study also revealed the business model behind this venture. Police said the suspect was involved in a subscription-based system and was charging Rs 15,000 for the initial deployment of the software and an additional Rs 15,000 per month for ongoing services.
Investigators said the suspect created customized fake applications based on customer requests that closely mimicked applications from banks, government agencies, and large corporations. These included fraudulent versions of applications and payment links linked to PNB, SBI, Axis Bank, UCO Bank, BigBasket, American Express and RTO Challan services, which were allegedly provided to cybercriminal organizations.
Police further said efforts are underway to identify and arrest other individuals involved in the network.
