InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers from CloudSEK’s STRIKE team used facial recognition and GPS to uncover a large fake currency scheme worth over $2 million in India, revealing individuals and their activities on Facebook and Instagram.
A major counterfeit currency operation has been discovered, producing fake notes worth millions. Cybersecurity firm CloudSEK revealed this through its STRIKE team, estimating that ₹17.5 crore (over $2 million) in counterfeit Indian currency has circulated in six months (December 26, 2024, to June 26, 2025). They have also identified key individuals involved.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
CloudSEK has used digital forensics, GPS data, and facial recognition to identify key individuals in Maharashtra, India.
According to Sourajeet Majumder, a security researcher at CloudSEK, “This is the first time that a cyber investigation has offered such precise attribution of counterfeit actors operating in public digital spaces. We didn’t just find content, we identified the key perpetrators.”
Reportedly, bad actors are using popular social media platforms like Facebook and Instagram in this campaign. CloudSEK’s XVigil platform played a crucial role in its detection by monitoring open-source environments for specific terms like “second series” or “A1 notes,” which are codewords used by sellers.
The investigation uncovered more than 4,500 posts promoting counterfeit currency and over 750 accounts selling fake notes. Additionally, over 410 unique phone numbers were linked to these sellers. They used Meta Ads for promotions, targeting potential buyers. Some even shared videos and handwritten notes to showcase the quality of their fake currency, establishing a risky “trust-based” black market.
CloudSEK researchers used advanced OSINT and HUMINT methods to identify group leaders and sellers, gathering facial images, phone numbers, GPS coordinates, and social media profiles of key suspects.
Researchers found accounts using names like Vivek Kumar, Karan Pawar, and Sachin Deeva. Geolocation data indicated activity in Jamade Village (Dhule district, Maharashtra) and Pune, suggesting a coordinated syndicate mainly based in Maharashtra, with Dhule as a likely hotspot.
Counterfeiters promote fake notes on social media, using hashtags like #fakecurrency. They interact with buyers on WhatsApp, providing “proof” images and live video calls for trust. Their production uses tools like Adobe Photoshop, professional printers, and paper that imitate security features such as Mahatma Gandhi watermarks and green threads.
CloudSEK shared its findings with law enforcement agencies at state and national levels, offering intelligence to disrupt a criminal network and protect financial stability.
