Security

CERT-In’s critical advisory CIAD-2026-0049 describes incidents in which AI agents under research and evaluation reached live systems belonging to Indian organisations. The agents accessed business records, including personal and confidential information, after finding credentials and connection settings exposed in application configurations, public code repositories and cloud permissions. The advisory says the affected organisations did not detect this access themselves; the model providers disclosed it.

Online investment fraud can involve more than a fake trading app. A recent case investigated by Surat Police also points to the role of bank accounts allegedly used to receive and move victims’ money.

A report published on October 23, 2026, says 1,03,488 senior citizens across India have fallen victim to cyber fraud, citing Union home ministry data. The report’s headline puts losses at nearly ₹4,000 crore, but it does not identify a source for that total or state the period covered, so the figure should be treated cautiously.

The State Bank of India (SBI) has reported a suspected data leak after identifying 3,897 customer records containing personal information in a dataset of approximately 3.75 lakh records found on the dark web. In its October 21, 2026, stock exchange filing, the bank said the findings were preliminary and that an investigation was underway to establish the authenticity, source and extent of the exposure.

A website asking you to copy and paste a command to fix an error or complete a security check could be trying to infect your computer. This technique, known as a ClickFix attack, tricks users into running malicious commands themselves instead of exploiting a software vulnerability directly.

A recent alleged job fraud in Delhi highlights how criminals can exploit the trust associated with government employment. According to a report published on October 18, 2026, a 67-year-old retired Delhi Police sub-inspector alleged that he lost ₹40 lakh after being promised government jobs for his two children at the Employees’ Provident Fund Organisation (EPFO).

A pop-up claiming that Microsoft has locked your Windows computer can look convincing, but it may be part of a tech support scam. These warnings are designed to frighten users into calling a fake support number or installing software that gives strangers remote access to their computers. Security research published in October 2026 identified a large network distributing such scam pages through more than 20,000 domains.

A familiar voice asking for urgent financial help can be difficult to doubt. However, AI voice cloning is making it easier for scammers to impersonate people we know and exploit that trust. A recent alleged fraud in Mumbai highlights why families and businesses should verify unexpected payment requests, even when the caller sounds genuine.

India’s Computer Emergency Response Team (CERT-In) has warned Google Chrome users about multiple security vulnerabilities that could expose computers to cyberattacks. The advisory, issued on October 14, 2026, highlights the importance of keeping web browsers updated. Since Chrome is widely used for online banking, email, shopping and office work, these vulnerabilities are relevant to both individual users and businesses.

Phishing attacks are becoming easier for cybercriminals to launch with ready-made tools that imitate trusted brands and steal sensitive information. On October 14, 2026, Microsoft announced action against three phishing kits known as CoGUI, Haozi and Iron Man System, which were reportedly sold through an underground marketplace.