Fake Kling AI Facebook Ads Deliver RAT Malware: Cyber Threat Explainer and Legal Remedies in India

The global surge in Generative Artificial Intelligence (GenAI) has created an unprecedented wave of curiosity among creators, corporate professionals, and digital consumers. Cybercriminals have wasted no time capitalising on this demand. A widespread malvertising campaign on Meta's Facebook platform recently weaponised fake advertisements promoting Kling AI—a popular AI-powered video generation tool—to distribute Remote Access Trojans (RATs) and infostealers to over 22 million potential victims globally, including thousands of active internet users across India.

At APS Law, our cyber law practice regularly monitors evolving attack vectors affecting businesses and individuals in Mumbai, Thane, and the wider Mumbai Metropolitan Region (MMR). This explainer examines how this malvertising campaign operates, the criminal liabilities triggered under Indian penal and technology statutes, and the precise steps victims must take to preserve digital evidence and pursue legal remedies.

Anatomy of the Threat: How Fake Kling AI Ads Deliver Malware

Kling AI, developed by Kuaishou, gained widespread acclaim for generating high-definition video clips from text prompts. Because access to the official tool initially required queuing or specific portal access, cyber adversaries identified an exploit window.

1. The Malvertising Vector

Adversaries created fraudulent Facebook business pages, often hijacked or spun up using forged identities, and purchased sponsored ads targeting users interested in AI tools, graphic design, and video editing. The ads used official logos, promotional video samples, and compelling calls-to-action such as "Download Kling AI Desktop Version for Free."

2. The Phishing Landing Page

Users who clicked the ads were redirected to convincing typosquatting landing pages (e.g., fraudulent domains mimicking legitimate download portals). These pages featured fake download counters, interface mockups, and fabricated user reviews.

3. Payload Delivery: Remote Access Trojans (RATs)

Instead of legitimate software, users downloaded an archive file (such as a password-protected .zip or .rar) containing a malicious loader. Once executed, the software silently deployed a Remote Access Trojan (such as Lumma Stealer, Rhadamanthys, or custom RAT payloads).

Unlike traditional ransomware, which openly demands extortion payments, a RAT operates covertly:

It extracts saved browser credentials, session cookies, and multi-factor authentication (MFA) tokens.
It harvests cryptocurrency wallet keys and banking portal credentials.
It grants the attacker remote administrative control over the infected workstation, allowing microphone recording, webcam activation, and secondary payload deployment.

For enterprises in commercial hubs like Bandra-Kurla Complex (BKC), Nariman Point, or Wagle Estate Thane, a single employee clicking such an ad on a work device can result in enterprise-wide lateral network compromise.

Applicable Indian Laws: BNS, IT Act, and Intermediary Obligations

Indian jurisprudence provides both civil compensation mechanisms and stringent criminal penalties against digital fraud, identity theft, and unauthorized computer access.

1. Information Technology Act, 2000 (IT Act)

Section 43 (Damage to Computer Systems): Introduces civil liability and mandates compensation for introducing computer contaminants, malware, or downloading data without authorization.
Section 66 (Computer-Related Offences): Criminalises dishonestly or fraudulently committing any act referred to in Section 43, punishable with imprisonment up to three years or a fine up to ₹5 lakh, or both.
Section 66C (Identity Theft): Penalises the fraudulent or dishonest use of another person's electronic signature, password, or other unique identification feature (triggered when stolen session cookies or credentials are used).
Section 66D (Cheating by Personation using Computer Resource): Directly applies to cyber adversaries impersonating Kling AI or its parent entity through spoofed digital ads and websites.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

Following the repeal of the Indian Penal Code, cyber-enabled fraud is now prosecuted under the Bharatiya Nyaya Sanhita, 2023:

Section 318 (Cheating): Applies to fraudulent inducements made via misleading advertisements designed to cause wrongful loss to victims.
Section 319 (Cheating by Personation): Enforced when attackers create deceptive digital personas or brand clones.
Section 336 & Section 340 (Forgery and Using Forged Documents/Electronic Records): Penalises the creation and transmission of counterfeit download packages and fraudulent domain certificates.
Section 61 (Criminal Conspiracy): Applied where coordinated syndicates run organised digital advertising scams.

3. Intermediary Liability under Section 79

Social media intermediaries like Meta operate under the safe harbour provisions of Section 79 of the IT Act, read alongside the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. However, intermediaries must exercise due diligence. When advertising networks consistently permit unverified, fraudulent ads to circulate to tens of millions of users without basic provenance checks, victims can issue legal notices demanding immediate takedowns and preservation of ad-buyer records.

Evidentiary Preservation Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA)

For any legal action—whether criminal reporting or civil damages—electronic evidence must be preserved according to statutory standards. The Bharatiya Sakshya Adhiniyam, 2023 (BSA) governs the admissibility of electronic records under Section 63 (which supersedes the erstwhile Section 65B of the Indian Evidence Act).

If you or your organisation has been targeted or compromised:

Do Not Immediately Wipe the Device: While disconnecting the infected machine from the local network (Wi-Fi and Ethernet) is vital to contain malware spread, do not format the drive. Formatting destroys forensic memory dumps and system logs.
Capture Full Metadata: Take screenshots of the deceptive Facebook advertisement, the Ad Library link (if accessible), the landing URL, and the payment or download trail.
Maintain Chain of Custody: Ensure system event logs, browser history files, and network traffic records are exported and stored on a clean, read-only external drive.
Prepare Section 63 BSA Certificate: Any electronic record submitted to law enforcement or court must be accompanied by the requisite certificate signed by a person occupying an official responsible position in relation to the device or management of the relevant activities.

Practical Steps: How Victims in Mumbai, Thane, and Mira Road Should Report

Victims discovering unauthorized financial debits, account hijackings, or corporate network intrusions must act swiftly:

1. Emergency Financial Freezing (Golden Hour)

If financial data or credentials were compromised, dial 1930 immediately (the National Cyber Crime Helpline) or lodge an incident ticket at cybercrime.gov.in. Prompt reporting within the first few hours allows the citizen financial cyber fraud reporting system to freeze funds in transit.

2. Lodging a Formal Police Complaint (Zero FIR under BNSS)

Under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), you are entitled to register a Zero FIR at any police station regardless of where the cyber offence took place.

For residents and commercial entities across the MMR, specialized cyber cells are equipped to handle malware incidents:

Mumbai: Cyber Police Stations are operational in regional zones (BKC Cyber Police Station, South Region at Worli, West Region at Bandra, and East Region).
Thane: The Thane Cyber Cell operates out of the Commissionerate at Court Naka, Thane West.
Mira-Bhayandar Vasai-Virar (MBVV): The MBVV Cyber Crime Cell operates in Mira Road, addressing online scams across the suburban belt.

3. Claiming Civil Compensation: Adjudicating Officer Mechanism

Under Section 46 of the IT Act, victims who have suffered financial injury due to unauthorized access or data theft can file an application before the State IT Secretary (acting as the Adjudicating Officer under the IT Act). In Maharashtra, this quasi-judicial forum has the authority to award monetary damages to affected parties.

Frequently Asked Questions (FAQs)

1. Is Meta legally liable if I downloaded malware from a sponsored Facebook ad?

While social media platforms generally invoke intermediary immunity under Section 79 of the IT Act, immunity is conditional upon compliance with due diligence obligations under the IT Rules, 2021. If an intermediary fails to expeditiously remove prohibited or malicious content upon receiving actual knowledge or court/government orders, it risks losing that immunity.

2. What is the difference between filing an FIR and an application under Section 46 of the IT Act?

An FIR registered under the BNS and Section 66 of the IT Act is a criminal proceeding aimed at identifying, arresting, and punishing the perpetrators. Conversely, a petition before the Adjudicating Officer under Section 46 is a civil remedy focused on awarding monetary compensation and damages for losses suffered due to cybersecurity breaches.

3. What should our company do if an employee downloaded this fake software on an office laptop?

Immediately isolate the machine from your internal network, revoke all corporate session tokens and active directory credentials associated with that user, and initiate an endpoint forensic audit. You should also evaluate whether the incident triggers mandatory 6-hour cybersecurity incident reporting to CERT-In (Indian Computer Emergency Response Team) under the CERT-In Directions of April 2022.

4. Can the police refuse to register my cyber complaint because the scammers operate from outside India?

No. Under Section 173 of the BNSS, police are obligated to register an FIR if the complaint discloses a cognizable offence. Further, Section 75 of the IT Act provides extra-territorial jurisdiction: offences committed outside India involving a computer, computer system, or computer network located in India are punishable under Indian law.

Legal Representation and Cyber Advisory with APS Law

Navigating the legal aftermath of a sophisticated malware attack requires strategic legal intervention, precise forensic evidence compliance under the BSA, and coordinated engagement with cyber enforcement authorities.

APS Law assists corporate entities, founders, and individuals across Mumbai, Thane, and Mira Road with cyber incident response, regulatory compliance, CERT-In reporting, and cyber fraud litigation.

If your systems have been compromised or you require assistance with cyber fraud reporting and asset recovery, contact APS Law to schedule an initial consultation with our cyber law team.