Delhi Police’s Cyber Cell has arrested an 18-year-old intermediate student from Gorakhpur for allegedly developing malicious Android Package Kit (APK) files used in cyber fraud. The suspect, who reportedly picked up programming and coding by watching YouTube tutorials, was tracked down in connection with an online theft of ₹17 lakh from a retired government employee in West Delhi. The victim was tricked into downloading an application on the pretext of updating a life certificate required for pension processing. Investigators took the student into custody from the Ramgarhtal police station area on Monday and transported him to the national capital on transit remand after presenting him before a local court.
The arrested youth has been identified as Karan Kumar, originally hailing from Patijeev village in the Dhanghata area of Sant Kabir Nagar district. He had been living in a rented flat on the first floor of building T/10 in Saket Nagar with his mother, Kavita, and sister, Ritika, while preparing for his Class 12 examinations. Delhi Police tracked his digital trail to Gorakhpur after forensic analysis of the technical setup used to siphon money from the pensioner’s bank account pointed directly to his operation.
Telegram network and monthly payoffs
Inquiries have revealed that Karan joined a Telegram channel approximately eight months ago. It was through this platform that he came into direct contact with Nishant Yadav, a resident of Varanasi. Investigators stated that Nishant hired the teenager to develop customized APK files specifically designed for phishing and remote mobile extraction. In exchange for his technical assistance, the student was allegedly paid a regular monthly retainer of ₹50,000.
The handler also incentivized the student with digital hardware to upgrade his development environment. Police confirmed that Nishant had gifted Karan an Apple MacBook to aid the illicit work. During the raid at the Saket Nagar residence, officers seized a laptop and an iPhone from his possession. The devices are undergoing digital examination to trace communication logs, payment transactions, and the specific distribution channels utilized by the network.
YouTube coding and malicious file design
During interrogation, Karan admitted that he learned coding principles, application structure, and mobile programming languages entirely through public tutorials on YouTube. The investigation has verified that he had authored at least two operational APK files. These packages were circulated under the names Root Force Live and Ginoshell.com. Furthermore, interrogations pointed to the deployment of an underlying software tool referenced as Digital Lutera within the fraudulent operations.
According to Superintendent of Police (City) Nimish Patil, the fraudulent operation targeted a retired person residing in the Hari Nagar area of West Delhi. The victim was promised smooth generation of an official life certificate online and was instructed to install an APK file directly onto an Android device. Once the installation was executed, the cybercriminals intercepted confidential credentials and drained ₹17 lakh from the victim’s bank balance. An FIR was promptly registered at the Hari Nagar Cyber Police Station, initiating the digital audit that culminated in the arrest.
Digital evidence and interstate manhunt
Cyber forensic specialists are currently examining the source codes, compiled scripts, and local logs retrieved from the seized laptop. The primary focus of the analysis is to decode the system architecture of the malicious packages, assess how incoming data was routed, identify additional victims, and track down the end beneficiary bank accounts that absorbed the stolen funds.
The inquiry has expanded beyond the arrested developer to target the broader operational syndicate. Two key associates have surfaced as suspects: Dipesh Patel, based in Patna, Bihar, and Bhavesh Yadav, based in Delhi. Teams from the Delhi Police are conducting raids across designated locations in both states to trace them.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
