InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers from CloudSEK’s STRIKE team used facial recognition and GPS to uncover a large fake currency scheme worth over $2 million in India, revealing individuals and their activities on Facebook and Instagram.
A major counterfeit currency operation has been discovered, producing fake notes worth millions. Cybersecurity firm CloudSEK revealed this through its STRIKE team, estimating that ₹17.5 crore (over $2 million) in counterfeit Indian currency has circulated in six months (December 26, 2024, to June 26, 2025). They have also identified key individuals involved.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
CloudSEK has used digital forensics, GPS data, and facial recognition to identify key individuals in Maharashtra, India.
According to Sourajeet Majumder, a security researcher at CloudSEK, “This is the first time that a cyber investigation has offered such precise attribution of counterfeit actors operating in public digital spaces. We didn’t just find content, we identified the key perpetrators.”
Reportedly, bad actors are using popular social media platforms like Facebook and Instagram in this campaign. CloudSEK’s XVigil platform played a crucial role in its detection by monitoring open-source environments for specific terms like “second series” or “A1 notes,” which are codewords used by sellers.
The investigation uncovered more than 4,500 posts promoting counterfeit currency and over 750 accounts selling fake notes. Additionally, over 410 unique phone numbers were linked to these sellers. They used Meta Ads for promotions, targeting potential buyers. Some even shared videos and handwritten notes to showcase the quality of their fake currency, establishing a risky “trust-based” black market.
CloudSEK researchers used advanced OSINT and HUMINT methods to identify group leaders and sellers, gathering facial images, phone numbers, GPS coordinates, and social media profiles of key suspects.
Researchers found accounts using names like Vivek Kumar, Karan Pawar, and Sachin Deeva. Geolocation data indicated activity in Jamade Village (Dhule district, Maharashtra) and Pune, suggesting a coordinated syndicate mainly based in Maharashtra, with Dhule as a likely hotspot.
Counterfeiters promote fake notes on social media, using hashtags like #fakecurrency. They interact with buyers on WhatsApp, providing “proof” images and live video calls for trust. Their production uses tools like Adobe Photoshop, professional printers, and paper that imitate security features such as Mahatma Gandhi watermarks and green threads.
CloudSEK shared its findings with law enforcement agencies at state and national levels, offering intelligence to disrupt a criminal network and protect financial stability.
