Loading story…
The Indian government has withdrawn a directive that would have required all smartphone manufacturers to preinstall the state-run Sanchar Saathi cyber safety app on new devices, following significant pushback from major industry players and privacy advocates. The original order, issued confidentially, mandated that the app be integrated into device firmware and not removable by users, raising concerns about user privacy, device security, and the precedent of government-mandated software on consumer electronics. Apple and Samsung, in particular, led the resistance, arguing that such requirements could introduce vulnerabilities and undermine user trust, with Apple reportedly refusing to comply in any market.
The swift policy reversal was confirmed by India’s telecoms ministry just days after the initial reports surfaced, ending a brief but intense standoff between the government and global handset makers. The episode highlights ongoing tensions between regulatory efforts to enhance cybersecurity and the tech industry’s insistence on user autonomy and secure device ecosystems. The withdrawal of the mandate is seen as a victory for privacy advocates and sets a precedent for future government-technology industry interactions in India.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Following industry resistance, the Indian government reversed the plan to make Sanchar Saathi mandatory on smartphones. Adoption of the app was instead made voluntary.
Major device manufacturers including Apple and Samsung, along with privacy advocates, pushed back against the proposed requirement. Critics cited privacy, device security, undeletable software concerns, and lack of industry consultation.
The Indian government moved to require smartphone makers to preinstall the state-run Sanchar Saathi cyber safety app on new devices. The app was intended to help combat mobile phone theft and SIM-related fraud.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcesecurityonline.info
Open sourcebbc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
India's telecommunications ministry has issued a directive requiring all major smartphone manufacturers, including Apple, Samsung, Vivo, Oppo, and Xiaomi, to preload a government-backed cybersecurity app called Sanchar Saathi on all new devices within 90 days. The app, which cannot be deleted or disabled by users, is designed to combat telecom fraud, spam, and malicious activity by allowing users to report suspicious calls, block stolen handsets, and monitor the number of mobile connections registered in their name. The government order also mandates that devices already in the supply chain receive the app via a software update, raising concerns among industry players and privacy advocates about the lack of prior consultation and potential privacy implications. Sanchar Saathi has already been installed over 11.4 million times and has played a significant role in blocking more than 4.2 million lost devices and recovering over 700,000 phones since its launch. The app's features include the ability to report international calls spoofed as domestic, helping authorities crack down on illegal telecom exchanges that facilitate scams and pose national security risks. The move underscores India's efforts to strengthen telecom cybersecurity amid a rapidly growing mobile user base exceeding 1.2 billion subscribers, but it also places the country alongside others like Russia in mandating pre-installed government software on consumer devices.
Jun 29, 2026
The Indian government has introduced new regulations requiring messaging apps such as WhatsApp, Telegram, Signal, and Snapchat to operate only with active SIM cards linked to users’ phone numbers. This move is intended to curb the rising incidents of cyber fraud and misuse, particularly those perpetrated from outside the country using Indian mobile numbers. Under the new rules, web and desktop sessions must automatically log out within six hours, and users will be required to re-verify their accounts frequently. Messaging app providers have 90 days to implement these changes and 120 days to report compliance, as part of an amendment to the 2024 Telecom Cyber Security Rules. The Department of Telecommunications (DoT) stated that the previous ability to maintain long-lived sessions without an active SIM was being exploited for large-scale, cross-border scams, phishing, and other fraudulent activities. By enforcing SIM-binding and frequent re-verification, authorities aim to close this security loophole and make it more difficult for criminals to operate anonymously or from abroad using Indian identifiers. The new measures are a direct response to the increasing sophistication of cybercriminals targeting Indian users through messaging platforms.
Jul 12, 2026
Indian authorities ordered the blocking of seven battery management system mobile apps, including **BAT-BMS**, after they were abused to remotely disable electric rickshaws and some e-scooters by connecting over Bluetooth to compatible lithium batteries. The misuse spread through viral videos and a prank trend known as the **Tirri Challenge**, leaving drivers stranded in traffic and causing service disruptions in multiple locations. Officials also linked the capability to extortion, including a case in Ujjain, Madhya Pradesh, where police arrested a suspect accused of immobilizing e-rickshaws and demanding payment from drivers. The Ministry of Electronics and Information Technology directed **Google** and **Apple** to remove the identified apps from their Indian app stores and warned marketplaces to apply greater due diligence where public safety is at risk. The action does not fully eliminate the threat, however, because the apps may still be available through third-party stores or alternate store regions, and vulnerable battery systems can still be accessed over Bluetooth if they lack password or PIN protection. The incident has intensified scrutiny of missing cybersecurity requirements in India’s e-rickshaw certification standards and the broader risks posed by connected electric mobility systems.
Jul 12, 2026