India Threat Landscape #01: Fake APKs Go Industrial, and the Edge Stays the Battleground

Most threat reporting is either global and generic, or locked behind a vendor paywall. Very little of it is built for the person defending an Indian bank, running security at an Indian startup, or just trying to keep their parents from installing a fake challan app. This brief is an attempt to fix that, in the open.

It's the first issue of something I'll keep up: a periodic read on the threats that actually matter here, backed by a new, free, machine-readable resource — the India Threat Tracker. Everything in the tracker is JSON you can pull into your own tooling, and the narrative pieces I write explain the items worth explaining.

So, the launch picture. Three fronts stand out.

India threat landscape — the state of play

1. Fake-APK fraud has become an industry

The single biggest everyday threat to ordinary people in India right now isn't a clever exploit. It's an Android app you install by hand after a WhatsApp message about a traffic fine, a gas bill, or a bank KYC update.

What changed in 2026 is the scale and the structure. This is no longer lone scammers. Police busts this year have exposed a full supply chain:

• Gujarat (June): a network running a Telegram storefront that sold, swapped and renewed fraud APKs. One distributor allegedly supplied ~400 fraudsters; linked losses ~₹54 lakh.
• Mumbai (June): an interstate syndicate tied to 3,206 complaints on the national portal and nearly ₹43 crore. Forensics found 111 distinct fake APKs, ~8,609 installs, and ~1.24 crore SMS siphoned off through servers on Firebase and Hostinger.
• Pune (June): two residents lost ₹14+ lakh to fake RTO e-challan APKs.

The technical playbook is consistent and well-documented by Indian teams like CYFIRMA and Cyble: two-stage droppers, SMS/OTP theft, fake UPI payment screens, hidden icons. I pulled it apart in The APK Is the Exploit. The short version: there's no vulnerability to patch here. The attack borrows the user's trust and the bank's reliance on SMS OTP.

Watching: the smishing-apk feed in the tracker, seeded with the campaigns above and their IOCs (defanged).

2. The edge is still the battleground

If fraud is the consumer story, internet-facing infrastructure is the enterprise one. Firewalls, VPNs and edge appliances remain the most reliable way into a network, and 2026 has kept that trend going.

• PAN-OS CVE-2026-0322 (October): a code-injection flaw in the Palo Alto management interface that turns an admin login into root, patched amid active exploitation with a three-day CISA deadline. Palo Alto alone now has 16 entries in CISA's KEV catalog. Breakdown: CVE-2026-0322.
• FrostArmada (April): APT28 changed one DNS setting on thousands of neglected home and small-office routers to intercept Microsoft 365 logins — MFA and all. A reminder that the "edge" now includes your staff's home routers. Breakdown: FrostArmada.
• And when edge access meets operational technology, you get results like the Polish CHP plant: an exposed VPN and a flat network, no malware, a stopped turbine.

The India angle: Indian enterprises run the same Fortinet, Palo Alto, Citrix, Ivanti and ManageEngine gear that dominates the KEV catalog. The exploited-cve feed in the tracker pulls CISA KEV daily, enriches it with EPSS, and tags the entries most relevant to tech with a heavy India footprint.

3. Regional espionage grinds on

Quieter, but persistent: Pakistan-nexus actors continue to target Indian government, defence and increasingly academic and research institutions.

• Transparent Tribe (APT36): spear-phishing with weaponised documents and LNK files, delivering RATs like Crimson RAT and CapraRAT.
• SideCopy: overlapping infrastructure, ZIP-and-LNK delivery chains, ActionRAT and AllaKore.

These aren't new actors, but they're durable, and they're squarely aimed at India. The apt-campaign feed tracks them as profiles you can reference.

What to actually do this month

Prioritised, not exhaustive:

1. Tell non-technical people one rule: a government department or bank will never send you an app to install. That single sentence blocks most APK fraud.
2. Patch your edge, and get management interfaces off the internet. If you run PAN-OS, 0322 is a this-week item; lock the management plane to a jump box regardless.
3. Move high-value logins to phishing-resistant MFA (passkeys/FIDO2). It's the one control that breaks the AiTM relay FrostArmada relied on.
4. If you're a bank or fintech: reduce reliance on SMS OTP and risk-score transactions. The entire APK ecosystem exists to steal that one six-digit code.

Use the tracker

The data behind this brief is open. Pull it:

# India-relevant, actively-exploited CVEs on the watchlist
curl -s https://raw.githubusercontent.com/sohankanna/india-threat-tracker/main/data/exploited-cve.json \
  | jq '.items[] | select(.india_relevance=="high" and .watchlist==true) | {cve, vendor, product, epss}'

# fake-APK campaign IOCs
curl -s https://raw.githubusercontent.com/sohankanna/india-threat-tracker/main/data/smishing-apk.json \
  | jq '.items[] | {title, iocs}'

Spotted a campaign or an IOC that should be in here? The repo takes contributions.

The takeaway

The threats that matter in India in late 2026 aren't exotic. Fraud that works because it borrows trust, edge devices that work because nobody patches them, and espionage that works because it's patient. None of it needs a zero-day to succeed, and most of it is defendable with unglamorous basics.

That's the point of doing this in the open: the defence isn't secret, it just needs to be said, in context, for the people who have to act on it. More next issue.

This article reflects public information as of 15 October 2026. The India Threat Tracker is live and updated continuously.

Sources

• India Threat Tracker (data + IOCs)
• ETV Bharat — Gujarat APK fraud racket bust
• Free Press Journal — Mumbai ₹43 crore APK fraud network
• CYFIRMA — RTO Challan Fraud technical report
• Cyble — GhostBat RAT
• Palo Alto Networks — CVE-2026-0322 advisory
• Microsoft Threat Intelligence — FrostArmada / SOHO router DNS hijacking