InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers from CloudSEK’s STRIKE team used facial recognition and GPS to uncover a large fake currency scheme worth over $2 million in India, revealing individuals and their activities on Facebook and Instagram.
A major counterfeit currency operation has been discovered, producing fake notes worth millions. Cybersecurity firm CloudSEK revealed this through its STRIKE team, estimating that ₹17.5 crore (over $2 million) in counterfeit Indian currency has circulated in six months (December 26, 2024, to June 26, 2025). They have also identified key individuals involved.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
CloudSEK has used digital forensics, GPS data, and facial recognition to identify key individuals in Maharashtra, India.
According to Sourajeet Majumder, a security researcher at CloudSEK, “This is the first time that a cyber investigation has offered such precise attribution of counterfeit actors operating in public digital spaces. We didn’t just find content, we identified the key perpetrators.”
Reportedly, bad actors are using popular social media platforms like Facebook and Instagram in this campaign. CloudSEK’s XVigil platform played a crucial role in its detection by monitoring open-source environments for specific terms like “second series” or “A1 notes,” which are codewords used by sellers.
The investigation uncovered more than 4,500 posts promoting counterfeit currency and over 750 accounts selling fake notes. Additionally, over 410 unique phone numbers were linked to these sellers. They used Meta Ads for promotions, targeting potential buyers. Some even shared videos and handwritten notes to showcase the quality of their fake currency, establishing a risky “trust-based” black market.
CloudSEK researchers used advanced OSINT and HUMINT methods to identify group leaders and sellers, gathering facial images, phone numbers, GPS coordinates, and social media profiles of key suspects.
Researchers found accounts using names like Vivek Kumar, Karan Pawar, and Sachin Deeva. Geolocation data indicated activity in Jamade Village (Dhule district, Maharashtra) and Pune, suggesting a coordinated syndicate mainly based in Maharashtra, with Dhule as a likely hotspot.
Counterfeiters promote fake notes on social media, using hashtags like #fakecurrency. They interact with buyers on WhatsApp, providing “proof” images and live video calls for trust. Their production uses tools like Adobe Photoshop, professional printers, and paper that imitate security features such as Mahatma Gandhi watermarks and green threads.
CloudSEK shared its findings with law enforcement agencies at state and national levels, offering intelligence to disrupt a criminal network and protect financial stability.
