Loading story…
India's telecommunications ministry has issued a directive requiring all major smartphone manufacturers, including Apple, Samsung, Vivo, Oppo, and Xiaomi, to preload a government-backed cybersecurity app called Sanchar Saathi on all new devices within 90 days. The app, which cannot be deleted or disabled by users, is designed to combat telecom fraud, spam, and malicious activity by allowing users to report suspicious calls, block stolen handsets, and monitor the number of mobile connections registered in their name. The government order also mandates that devices already in the supply chain receive the app via a software update, raising concerns among industry players and privacy advocates about the lack of prior consultation and potential privacy implications.
Sanchar Saathi has already been installed over 11.4 million times and has played a significant role in blocking more than 4.2 million lost devices and recovering over 700,000 phones since its launch. The app's features include the ability to report international calls spoofed as domestic, helping authorities crack down on illegal telecom exchanges that facilitate scams and pose national security risks. The move underscores India's efforts to strengthen telecom cybersecurity amid a rapidly growing mobile user base exceeding 1.2 billion subscribers, but it also places the country alongside others like Russia in mandating pre-installed government software on consumer devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
India backed off the requirement that all new smartphones ship with the government app preinstalled, citing growing voluntary adoption of Sanchar Saathi. Privacy advocates welcomed the reversal, though some said they were still waiting for a formal legal order.
Separate but related anti-fraud rules were introduced requiring messaging platforms such as WhatsApp, Telegram, and Signal to link accounts to SIM cards and enforce regular sign-outs. Analysts warned the measures could disrupt users and might not effectively reduce scams.
After criticism intensified, the government said the app was optional and that users would be able to remove it, contradicting the earlier undeletable-preload requirement. Skepticism remained because observers were awaiting formal confirmation of the policy change.
Opposition politicians, digital-rights groups, and industry stakeholders criticized the mandate as government overreach that could expand surveillance and undermine user control. Apple reportedly signaled it could not comply because mandatory third-party software would conflict with iOS security architecture.
India's telecom or communications ministry privately directed smartphone manufacturers including Apple, Samsung, Xiaomi, Vivo, and Oppo to preload the state-owned Sanchar Saathi app on new devices and make it non-removable. The measure was presented as a cyber-safety and anti-fraud initiative.
India launched the government-backed Sanchar Saathi app to help users address telecom fraud, spoofed or duplicate IMEI scams, and phone theft. Later reporting says the app had been available for about two years and had reached roughly 10–14 million downloads/users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcetherecord.media
Open sourcescworld.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourcesecurityonline.info
Open sourcereuters.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Indian government has withdrawn a directive that would have required all smartphone manufacturers to preinstall the state-run Sanchar Saathi cyber safety app on new devices, following significant pushback from major industry players and privacy advocates. The original order, issued confidentially, mandated that the app be integrated into device firmware and not removable by users, raising concerns about user privacy, device security, and the precedent of government-mandated software on consumer electronics. Apple and Samsung, in particular, led the resistance, arguing that such requirements could introduce vulnerabilities and undermine user trust, with Apple reportedly refusing to comply in any market. The swift policy reversal was confirmed by India’s telecoms ministry just days after the initial reports surfaced, ending a brief but intense standoff between the government and global handset makers. The episode highlights ongoing tensions between regulatory efforts to enhance cybersecurity and the tech industry’s insistence on user autonomy and secure device ecosystems. The withdrawal of the mandate is seen as a victory for privacy advocates and sets a precedent for future government-technology industry interactions in India.
Jun 29, 2026
The Indian government has introduced new regulations requiring messaging apps such as WhatsApp, Telegram, Signal, and Snapchat to operate only with active SIM cards linked to users’ phone numbers. This move is intended to curb the rising incidents of cyber fraud and misuse, particularly those perpetrated from outside the country using Indian mobile numbers. Under the new rules, web and desktop sessions must automatically log out within six hours, and users will be required to re-verify their accounts frequently. Messaging app providers have 90 days to implement these changes and 120 days to report compliance, as part of an amendment to the 2024 Telecom Cyber Security Rules. The Department of Telecommunications (DoT) stated that the previous ability to maintain long-lived sessions without an active SIM was being exploited for large-scale, cross-border scams, phishing, and other fraudulent activities. By enforcing SIM-binding and frequent re-verification, authorities aim to close this security loophole and make it more difficult for criminals to operate anonymously or from abroad using Indian identifiers. The new measures are a direct response to the increasing sophistication of cybercriminals targeting Indian users through messaging platforms.
Jul 12, 2026
Indian officials and agencies are pushing to broaden the use of digital identity in both public and private contexts, while explicitly raising cybersecurity and accountability concerns. In Hyderabad, Police Commissioner **V.C. Sajjanar** publicly argued that autonomous **AI agents** operating in critical sectors (e.g., banks, hospitals, power grids) should be issued a verifiable *digital identity* and be subject to strong **logging and traceability** so investigators can determine “which agent opened which file,” what changes were made, and where data was sent—framing the need as a safeguard against errors and the risk of **cybercriminals hijacking agent behavior**. Separately, India’s **UIDAI** is expanding **Aadhaar** into more day-to-day use via a new Aadhaar app and an **offline verification** framework intended to reduce reliance on real-time checks against the central database, while enabling *selective disclosure* (e.g., proving age without sharing full birthdate). The initiative also extends Aadhaar into consumer ecosystems (including planned **Google Wallet** integration and discussions with **Apple Wallet**) and into operational deployments such as policing and hospitality—e.g., Ahmedabad City Crime Branch integrating Aadhaar-based offline verification with the **PATHIK** guest-monitoring platform—prompting critics to reiterate concerns about **security, consent, and privacy** as Aadhaar’s footprint grows.
Jun 29, 2026