Loading story…
India’s Cyber Crime Coordination Centre (I4C) ordered GitHub to disable access to three public repositories tied to Bitchat, a decentralized Bluetooth Low Energy mesh messaging app created by Jack Dorsey through Permissionless Technologies. The notice, issued under Section 79(3)(b) of the Information Technology Act, 2000 and Rule 3(1)(d) of the Information Technology Rules, 2021, named permissionlesstech/bitchat, permissionlesstech/bitchat-android, and permissionlesstech/bitchat-android/releases, and reportedly gave GitHub three hours to comply. Authorities said Bitchat’s peer-to-peer design, lack of mandatory registration, absence of centralized servers and logs, and ability to work without internet connectivity obstruct lawful interception, subscriber attribution, and criminal investigations.
The order is notable because it targets open-source code repositories rather than a live website, social platform, or deployed application, marking a direct regulatory challenge to decentralized communications software. Reports said the move came amid protests in New Delhi, where internet shutdowns had been imposed and demonstrators were reportedly using offline tools such as Bitchat; critics including the Internet Freedom Foundation called the action unconstitutional and authoritarian, arguing the cited law does not authorize blocking and that the compressed deadline limited legal recourse. As of reporting, the repositories were still accessible on GitHub, while forks and previously installed copies were expected to reduce the practical effect of any takedown.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
As of press time, the targeted Bitchat repositories were still accessible on GitHub despite the Indian government's takedown demand. Reporting also noted that forks and already-installed copies would limit the practical effect of any removal.
After the order was issued, the Internet Freedom Foundation publicly criticized it as unconstitutional and authoritarian. The group argued the cited legal provision does not authorize blocking and said the three-hour deadline undermined legal recourse.
On 2026-07-23, India's Cyber Crime Coordination Centre (I4C) issued a notice directing GitHub to disable access to three public repositories associated with Jack Dorsey-backed Bitchat under Section 79(3)(b) of the IT Act and related rules. The order reportedly gave GitHub three hours to comply and argued Bitchat's decentralized, offline-capable design hindered lawful interception and investigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcethecybersecguru.com
Open sourcethedefiant.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Indian authorities ordered the blocking of seven battery management system mobile apps, including **BAT-BMS**, after they were abused to remotely disable electric rickshaws and some e-scooters by connecting over Bluetooth to compatible lithium batteries. The misuse spread through viral videos and a prank trend known as the **Tirri Challenge**, leaving drivers stranded in traffic and causing service disruptions in multiple locations. Officials also linked the capability to extortion, including a case in Ujjain, Madhya Pradesh, where police arrested a suspect accused of immobilizing e-rickshaws and demanding payment from drivers. The Ministry of Electronics and Information Technology directed **Google** and **Apple** to remove the identified apps from their Indian app stores and warned marketplaces to apply greater due diligence where public safety is at risk. The action does not fully eliminate the threat, however, because the apps may still be available through third-party stores or alternate store regions, and vulnerable battery systems can still be accessed over Bluetooth if they lack password or PIN protection. The incident has intensified scrutiny of missing cybersecurity requirements in India’s e-rickshaw certification standards and the broader risks posed by connected electric mobility systems.
Jul 12, 2026
Lawyers and executives linked to **Appin Technology**, its cofounder **Rajat Khare**, and the **Association of Appin Training Centers** have been accused of using lawsuits and legal threats to suppress reporting that Appin operated as a hack-for-hire outfit. The pressure campaign followed a Reuters investigation alleging that Appin spied on opposition leaders, corporate rivals, lawyers, and wealthy individuals for clients around the world; an interim Delhi court order then required Reuters to remove that article, and Reuters has challenged the order in India. The takedown effort expanded to other publishers and platforms, prompting a public pushback from **Techdirt**, **MuckRock**, and the **Electronic Frontier Foundation**. They argue the Indian injunction applies only to Reuters and Google, does not create a global removal obligation, and would be difficult to enforce in the United States under the **First Amendment** and the **SPEECH Act**. The dispute has instead amplified scrutiny of the original allegations, with republication efforts and wider coverage turning the attempted suppression into a broader anti-censorship fight.
Jun 29, 2026
GitHub disabled more than 70 Microsoft-owned repositories after detecting a suspected **Miasma** worm campaign that inserted malicious code into open source projects and disrupted dependent CI/CD workflows. Researchers said the incident began with a compromised contributor account pushing a malicious commit to `Azure/durabletask`, adding configuration files that could trigger remote code execution when developers opened the repository in IDEs or AI coding tools including **Claude Code**, **Gemini CLI**, and **Cursor**. Microsoft’s response was unusual because it shut down its own repositories rather than only removing the offending content, and GitHub reportedly disabled 73 repositories in rapid succession after automated detections fired. The activity appears tied to a broader supply-chain operation linked to earlier compromises of Microsoft’s `durabletask` PyPI package and to a newer campaign tracked by StepSecurity as **Hades**, which it describes as an evolution of Miasma. StepSecurity said the malware uses obfuscated Python import hooks to fetch additional payloads, scrape memory across Linux, macOS, and Windows, steal cloud and developer credentials, abuse GitHub Actions and OIDC/Sigstore workflows, move laterally over SSH/SCP, and backdoor IDE and AI assistant configuration files. The campaign also reportedly uses GitHub-based command-and-control and includes a token-monitoring component that can trigger a destructive wiper if a stolen GitHub token is revoked, underscoring the risk to software supply chains and AI-assisted development environments.
Jun 29, 2026