Cybercriminals in Maharashtra’s Thane district have orchestrated a sophisticated online fraud scheme by posing as gas utility representatives and tricking consumers into downloading a malicious application. The scam has affected 22 individuals, resulting in cumulative losses of approximately ₹31.43 lakh. Among the victims is a 60-year-old retired man who lost ₹8.68 lakh from his bank accounts within a matter of hours.
The specialized cyber operations cell has initiated a wide digital forensics search to isolate the malicious hosting origins of the payload.
Registration Begins for FutureCrime Summit 2026, India’s Largest Cybercrime Conference
The Nominal Transaction Bait Strategy
The fraud ring targeted a resident of the Khadakpada area in Kalyan. The victim received a highly targeted WhatsApp message from an individual identifying himself as “Divesh Joshi,” who claimed to be a customer processing representative with Mahanagar Gas Limited. The contact notified the retired individual that his household gas distribution files required immediate modification to prevent service suspension.
To execute the compliance modifications, the operator transmitted a synthetic Android package file titled Mahanagar Gas bill update http://Online.apk. The victim was instructed to install the platform and authorize a nominal processing fee of ₹10 using his debit card to validate his utility profile.
Malware Infiltration and Circular OTP Theft
When the initial debit card validation attempt failed due to a simulated system timeout, the fraudster instructed the victim to input details from a secondary backup bank card. This sequence allowed the malicious background installation to capture multiple financial profiles simultaneously.
The underlying cyber crime investigation indicates that the package file carried highly invasive malware capable of monitoring live displays, scraping keystrokes, and automatically reading inward SMS directories. Within a short operational window, the syndicate intercepted six consecutive incoming One-Time Passwords (OTPs), executing six rapid transfers that extracted ₹8.68 lakh across two separate banking accounts before the victim could lock his credentials.
Dozens of Utility Profiles Exploited Simultaneously
As regional cyber investigators tracked the transaction nodes and communication routing footprints associated with the suspect number, the scope of the phishing operations expanded significantly. Digital data matching revealed that the same group had successfully deployed identical utility modification templates against 21 alternative victims residing across the district corridor.
The cluster of secondary victims suffered an aggregate loss of ₹22.74 lakh, pushing the total siphoned capital volume registered within this specific network module to ₹31.43 lakh.
Escalation Under the Modern Penal Framework
Following a comprehensive verification of the digital footprints and bank settlement routes, the Khadakpada police officially registered a criminal case against the unidentified operators. The network has been booked under Section 318(4) of the Bharatiya Nyaya Sanhita (BNS) for cheating, alongside multiple statutory provisions of the Information Technology Act.
Renowned cybercrime expert and former IPS officer Prof. Triveni Singh said cybercriminals are increasingly relying on advanced social engineering techniques to manipulate victims. According to him, fraudsters create situations that make individuals fear service disruption, overdue bills, or account-related problems. This psychological pressure often persuades victims to click links or install malicious applications without conducting proper verification. He urged consumers to never install external packages outside authorized digital marketplaces.
