InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers from CloudSEK’s STRIKE team used facial recognition and GPS to uncover a large fake currency scheme worth over $2 million in India, revealing individuals and their activities on Facebook and Instagram.
A major counterfeit currency operation has been discovered, producing fake notes worth millions. Cybersecurity firm CloudSEK revealed this through its STRIKE team, estimating that ₹17.5 crore (over $2 million) in counterfeit Indian currency has circulated in six months (December 26, 2024, to June 26, 2025). They have also identified key individuals involved.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
CloudSEK has used digital forensics, GPS data, and facial recognition to identify key individuals in Maharashtra, India.
According to Sourajeet Majumder, a security researcher at CloudSEK, “This is the first time that a cyber investigation has offered such precise attribution of counterfeit actors operating in public digital spaces. We didn’t just find content, we identified the key perpetrators.”
Reportedly, bad actors are using popular social media platforms like Facebook and Instagram in this campaign. CloudSEK’s XVigil platform played a crucial role in its detection by monitoring open-source environments for specific terms like “second series” or “A1 notes,” which are codewords used by sellers.
The investigation uncovered more than 4,500 posts promoting counterfeit currency and over 750 accounts selling fake notes. Additionally, over 410 unique phone numbers were linked to these sellers. They used Meta Ads for promotions, targeting potential buyers. Some even shared videos and handwritten notes to showcase the quality of their fake currency, establishing a risky “trust-based” black market.
CloudSEK researchers used advanced OSINT and HUMINT methods to identify group leaders and sellers, gathering facial images, phone numbers, GPS coordinates, and social media profiles of key suspects.
Researchers found accounts using names like Vivek Kumar, Karan Pawar, and Sachin Deeva. Geolocation data indicated activity in Jamade Village (Dhule district, Maharashtra) and Pune, suggesting a coordinated syndicate mainly based in Maharashtra, with Dhule as a likely hotspot.
Counterfeiters promote fake notes on social media, using hashtags like #fakecurrency. They interact with buyers on WhatsApp, providing “proof” images and live video calls for trust. Their production uses tools like Adobe Photoshop, professional printers, and paper that imitate security features such as Mahatma Gandhi watermarks and green threads.
CloudSEK shared its findings with law enforcement agencies at state and national levels, offering intelligence to disrupt a criminal network and protect financial stability.
