InfoSecBulletin Cybersecurity for mankind
India’s Department of Telecommunications has given phone makers 90 days to pre-install a state-owned app on new devices and push it to current phones through software updates, according to Reuters. This order was sent to manufacturers like Apple, Samsung, Vivo, Oppo, and Xiaomi on November 28th.
The state-owned Sanchar Saathi app is currently on the App Store and Google Play Store, but this order will require it to remain active and cannot be deleted. The app allows users to block and track lost or stolen phones using their IMEI, and report potential fraud messages.
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
Critical Cisco ISE Vulnerability Enables Remote Code Execution
F5 Patches NGINX Flaw for Code Execution and DoS Attacks
FortiBleed: 70,000 Fortinet Firewalls Compromised Globally
New Rokarolla Android malware hits 217 banking and crypto apps
Phishing Campaign Exploits Legitimate Microsoft Login Flow
ALERT
Cisco SD-WAN Zero-Day, FortiSandbox and cPanel flaws exploited in attacks
“Panthalassa” builds floating AI data centers powered by ocean waves
Critical Wazuh Vuln Enables Alert Tampering and Evidence Deletion
Apple’s iOS users in India remain few, but their sales reached a record $9 billion in September. Google has also started selling Pixel phones online in India this year, and both companies have boosted local device manufacturing.
Nikhil Pahwa, founder of tech policy analysis company Medianama, said the order was “bad news” for mobile phone users and their privacy. “Legally, one can argue that your mobile phone is your personal space, and this is an invasion of your personal space. It’s where we have our most private conversations and exchange sensitive information with people we trust. How do we know this app isn’t used to access files and messages on our device? Or a future update won’t do that? This is clearly an invasion of our privacy. Remember how govt exempts itself from much of the Data Protection Law. This explains why,” Pahwa said. The order is valid even for devices being imported into the country, or still in pre-sales transit.
The direction has been given under Telecommunications (Telecom Cyber Security) Rules, 2024, and its further amendments.
Cybernews reported, “Apple however does not plan to comply with the directive and will tell the government it does not follow such mandates anywhere in the world as they raise a host of privacy and security issues for the company’s iOS ecosystem, said two of the industry sources who are familiar with Apple’s concerns. They declined to be named publicly as the company’s strategy is private.
“Its not only like taking a sledgehammer, this is like a double-barrel gun,” said the first source.”
Will it Go the Way of Russia’s MAX?
India has followed Russia’s example by requiring the pre-installation of a local messenger app called MAX on all smartphones, tablets, computers, and smart TVs sold in the country from September 1, 2025. Critics worry the app may track users, but state media has denied these claims.
Russian authorities have since announced partial restrictions on voice and video calls in messaging apps Telegram and WhatsApp to counter criminal activity, with state communications watchdog Roskomnadzor threatening to block WhatsApp completely if the messaging platform fails to comply with Russian law.
latest update:
In a statement shared on X on December 2, 2025, India’s telecom minister Jyotiraditya M. Scindia said “this is a completely voluntary and democratic system” and that “users may choose to activate the app and avail its benefits, or if they do not wish to, they can easily delete it from their phone at any time.”
India’s New Login Rules for WhatsApp, Telegram & Other Messaging Apps
