Loading story…
The Indian government has introduced new regulations requiring messaging apps such as WhatsApp, Telegram, Signal, and Snapchat to operate only with active SIM cards linked to users’ phone numbers. This move is intended to curb the rising incidents of cyber fraud and misuse, particularly those perpetrated from outside the country using Indian mobile numbers. Under the new rules, web and desktop sessions must automatically log out within six hours, and users will be required to re-verify their accounts frequently. Messaging app providers have 90 days to implement these changes and 120 days to report compliance, as part of an amendment to the 2024 Telecom Cyber Security Rules.
The Department of Telecommunications (DoT) stated that the previous ability to maintain long-lived sessions without an active SIM was being exploited for large-scale, cross-border scams, phishing, and other fraudulent activities. By enforcing SIM-binding and frequent re-verification, authorities aim to close this security loophole and make it more difficult for criminals to operate anonymously or from abroad using Indian identifiers. The new measures are a direct response to the increasing sophistication of cybercriminals targeting Indian users through messaging platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Under the new mandate, messaging providers were given 90 days to implement SIM-device binding and 120 days to report compliance to authorities. The measure extends device-binding practices already used in banking to consumer messaging platforms.
India's Department of Telecommunications introduced new requirements for messaging apps such as WhatsApp, Telegram, Signal, and Snapchat to work only with active, KYC-linked SIM cards. The rules also require web sessions to auto-logout every six hours, as part of an amendment to the 2024 Telecom Cyber Security Rules aimed at reducing cyber fraud and misuse.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
India's telecommunications ministry has issued a directive requiring all major smartphone manufacturers, including Apple, Samsung, Vivo, Oppo, and Xiaomi, to preload a government-backed cybersecurity app called Sanchar Saathi on all new devices within 90 days. The app, which cannot be deleted or disabled by users, is designed to combat telecom fraud, spam, and malicious activity by allowing users to report suspicious calls, block stolen handsets, and monitor the number of mobile connections registered in their name. The government order also mandates that devices already in the supply chain receive the app via a software update, raising concerns among industry players and privacy advocates about the lack of prior consultation and potential privacy implications. Sanchar Saathi has already been installed over 11.4 million times and has played a significant role in blocking more than 4.2 million lost devices and recovering over 700,000 phones since its launch. The app's features include the ability to report international calls spoofed as domestic, helping authorities crack down on illegal telecom exchanges that facilitate scams and pose national security risks. The move underscores India's efforts to strengthen telecom cybersecurity amid a rapidly growing mobile user base exceeding 1.2 billion subscribers, but it also places the country alongside others like Russia in mandating pre-installed government software on consumer devices.
Jun 29, 2026
WhatsApp is preparing to introduce unique usernames that would let people message each other without sharing phone numbers, a change positioned as a privacy improvement for group chats, events, and first-time contacts. The feature is designed without a public directory, requiring users to know an exact username, but officials and cybersecurity authorities have warned it could also make impersonation and phishing easier by allowing attackers to register lookalike names resembling trusted individuals, brands, banks, or government bodies. India’s Ministry of Electronics and Information Technology (**MeitY**) has asked WhatsApp to suspend the rollout until it receives government approval, arguing the feature could fuel phishing, so-called digital arrest scams, and fraud targeting public authorities and financial institutions in WhatsApp’s largest market of more than 850 million users. WhatsApp said it plans safeguards including contextual warnings, reserved usernames for legitimate organizations, lookalike protections, contact-initiation limits, anti-enumeration controls, and abuse-detection systems, while security guidance has urged users to verify suspicious contacts through official channels and advised organizations to reserve official usernames early and clearly communicate their legitimate accounts.
Jul 8, 2026
Security researchers and intelligence analysts have documented a series of incidents and trends highlighting the risks to mobile messaging accounts and devices. In December, a new form of WhatsApp account hijacking called GhostPairing was identified, where attackers trick users into linking an attacker-controlled browser to their WhatsApp device, potentially exposing sensitive information. Separately, researchers uncovered large-scale scraping of WhatsApp's contact discovery tool, resulting in the exposure of billions of phone numbers and associated profile data. Meanwhile, spyware threats targeting both iPhone and Android users have escalated, with zero-click attacks enabling adversaries to compromise devices and access encrypted messaging apps such as WhatsApp and Signal. Apple and Google responded by patching vulnerabilities believed to be exploited by commercial spyware like Predator, and the US CISA issued warnings about the active targeting of mobile messaging applications. In another high-profile case, the Iranian-linked Handala hacking group claimed to have fully compromised the mobile devices of two Israeli officials. However, forensic analysis revealed that only their Telegram accounts were breached, not the entire devices. The attackers likely used techniques such as SIM swapping, SS7 exploitation, and phishing to gain access, exposing gaps in session management and account security on encrypted messaging platforms. These incidents underscore the growing sophistication of attacks against mobile messaging services and the need for robust security measures, including privacy controls, passkey-encrypted backups, and vigilance against phishing and SIM-based attacks.
Jun 29, 2026