Hackers Using Fake Video Conferencing Apps to Target Web3 Professionals: Legal Remedies in India

The decentralized nature of the Web3 ecosystem has fostered a borderless, remote-first work culture. Developers, founders, smart contract auditors, and community managers routinely close six-figure funding rounds, broker partnerships, and conduct hiring interviews entirely over video calls.

However, this heavy reliance on digital conferencing has exposed a critical vulnerability. Sophisticated threat actor groups are systematically deploying counterfeit video conferencing applications—mimicking platforms like Zoom, Google Meet, Microsoft Teams, and Skype—to compromise Web3 professionals, exfiltrate private credentials, and drain digital asset wallets.

For professionals and technology startups across India, particularly in tech and financial hubs like Mumbai and Pune, these attacks represent not just a technical compromise, but a complex criminal crisis requiring immediate forensic preservation and aggressive legal action.

The Modus Operandi: How the Attack Unfolds

Unlike indiscriminate phishing campaigns, these operations rely on highly tailored social engineering. The attackers do not merely send random spam; they research targets on X (formerly Twitter), Telegram, Discord, and LinkedIn.

1. The Pretext

The victim is approached by an entity posing as a venture capital investor, a high-profile podcaster, a talent recruiter, or a prospective Web3 client seeking bespoke smart contract development. After brief, convincing initial correspondence, the attacker insists on scheduling a video conference to discuss terms.

2. The Lure

The victim receives an invitation containing a malicious link resembling an authentic platform (e.g., us05-zoom[.]app or meet-google-join[.]us). When the victim attempts to join, the page displays a simulated error—such as "Audio driver incompatible" or "Update required to load conference space"—and prompts the user to download an executable launcher or update package.

3. Payload Execution and Data Exfiltration

Once launched, the software runs a legitimate-looking installer while silently executing an "infostealer" in the background (frequently variants of Lumma Stealer, RedLine, or macOS-targeted AppleScript/AMOS binaries). The malware rapidly scrapes:

Local browser data, session tokens, and authentication cookies.
Non-custodial browser extension wallets (MetaMask, Phantom, Rabby, Keplr) and their local vault files.
Desktop messaging sessions (Telegram, Discord) and stored SSH/FTP keys.
Password managers and system clipboards.

Within minutes, the threat actors access the victim’s accounts, bypass multi-factor authentication using hijacked session cookies, and initiate automated transfers draining digital assets from associated wallets.

Applicable Indian Cyber and Criminal Laws

Victims of these attacks in India have strong legal recourse. The offense involves multiple statutory violations under the Information Technology Act, 2000 (IT Act) and the Bharatiya Nyaya Sanhita, 2023 (BNS).

Provisions Under the Information Technology Act, 2000

Section 43 (Damage to Computer System): Provides for civil compensation when someone introduces a computer contaminant, downloads/copies data without permission, or disrupts computer networks.
Section 66 (Computer Related Offences): Criminalizes dishonest or fraudulent acts under Section 43, carrying imprisonment of up to three years or a fine up to ₹5 lakh, or both.
Section 66C (Identity Theft): Applies directly to the theft and fraudulent use of private keys, seed phrases, passwords, or unique digital signatures.
Section 66D (Cheating by Personation): Punishes individuals who cheat using computer resources or communication devices by posing as recruiters, investors, or legitimate conferencing platforms.

Offenses Under the Bharatiya Nyaya Sanhita, 2023 (BNS)

With the criminal law reforms replacing the Indian Penal Code (IPC), complaints must now be framed under the BNS:

Section 318 (Cheating): Replaces IPC Section 415/420, prosecuting those who dishonestly induce victims to download malicious files under false pretenses.
Section 303 (Theft): Replaces IPC Section 378/379, invoked when digital assets or proprietary intellectual property are moved out of the victim's possession without consent.
Section 336 & Section 340 (Forgery and Using Forged Documents): Pertains to creating fraudulent domains and spoofed applications bearing the marks of legitimate corporate conferencing services.
Section 61 (Criminal Conspiracy): Pertains to organized syndicate operations orchestrating multi-jurisdictional cyber heists.

Evidence Preservation Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA)

In cyber theft, time is your greatest adversary. Once malware executes, victims often instinctively reboot, format, or reinstall operating systems. Do not do this.

Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA), which governs the admissibility of evidence in Indian courts, electronic records are admissible under Section 61 and Section 63 (the successor to Section 65B of the Indian Evidence Act). To ensure your evidence holds up during police investigation and judicial proceedings:

Isolate the Device: Immediately disconnect from Wi-Fi and ethernet to halt outbound data transfers. Do not wipe the hard drive.
Capture Digital Footprints: Save the entire chat history from LinkedIn, Telegram, or X where the malicious link was shared. Take clean screenshots showing visible URLs and timestamps.
Preserve Network Logs: Document browser history, download folder timestamps, and the specific domain used to deliver the payload.
Document On-Chain Transactions: Identify destination wallet addresses, transaction hashes (TXIDs), and smart contract interactions using block explorers like Etherscan or Solscan.
Comply with Section 63 BSA: Secure a certificate under Section 63 of the BSA signed by the person in lawful control of the computer or mobile device producing the electronic logs.

Step-by-Step Reporting Guide for Mumbai Metropolitan Victims

If you are a Web3 founder, developer, or freelancer based in Mumbai, Thane, or Mira Road, follow these reporting steps without delay:

Step 1: Immediate National Portal & Helpline Registration

Dial 1930 (the National Cyber Crime Helpline) within the "golden hour" of the attack. Promptly register an incident on the National Cyber Crime Reporting Portal (cybercrime.gov.in). Ensure you upload all wallet addresses, transaction hashes, and the malicious installation URL.

Step 2: Filing a Formal Complaint at Local Cyber Cells

A formal written complaint should be submitted to the jurisdictional Cyber Police Station under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) to register a First Information Report (FIR):

Mumbai Jurisdiction: Victims can approach the BKC Cyber Police Station (Bandra-Kurla Complex) or their regional cyber cell (e.g., South Region Cyber Cell at Worli, or North Region at Kandivali).
Thane Jurisdiction: Approach the Thane Cyber Cell, located near the Commissioner of Police Office, Court Naka, Thane.
Mira-Bhayandar & Vasai-Virar (MBVV): File the formal complaint at the MBVV Cyber Crime Cell located in Poonam Sagar Complex, Mira Road (East).

Step 3: Engaging with Exchanges via Nodal Officers

If the drained funds are moved through centralized cryptocurrency exchanges (such as Binance, CoinDCX, WazirX, or OKX), the cyber cell investigating officer can issue urgent notices under Section 94 of the BNSS (summons to produce documents) and request emergency freezing of the associated exchange accounts under Section 107 of the BNSS.

Frequently Asked Questions (FAQs)

1. Are stolen cryptocurrencies and tokens legally recognized under Indian criminal law?

Yes. While cryptocurrency is not legal tender in India, digital tokens represent intangible property and "computer data/information" under the IT Act and Section 2(21) of the BNS. Indian law enforcement agencies and courts regularly entertain criminal complaints involving stolen virtual digital assets.

2. Can I pursue the attackers if they operate from outside India?

Yes. Under Section 75 of the IT Act, the provisions of the Act apply to any offense or contravention committed outside India by any person, irrespective of nationality, if the act involves a computer, computer system, or computer network located in India. Indian authorities can liaise with international agencies via Interpol red notices or mutual legal assistance treaties (MLATs).

3. What if the police refuse to register an FIR for digital asset theft?

If a local police station hesitates to register an FIR due to the technical complexity of the matter, you have the right under Section 173(4) of the BNSS to approach the Superintendent of Police or Commissioner of Police. If the issue persists, an application can be filed before the competent Judicial Magistrate under Section 175(3) of the BNSS seeking directions for an investigation.

4. Can civil damages be claimed from the hackers in India?

Yes. Under Section 43 read with Section 46 of the IT Act, you can file an Adjudicating Petition before the IT Secretary (acting as the Adjudicating Officer of the State of Maharashtra) seeking financial compensation for the unauthorized access and exfiltration of data.

Protecting Your Web3 Practice

Technical prevention remains your primary defense:

Never launch downloads prompted by web conferencing invite links; join directly via browser-native WebRTC when possible.
Use dedicated, cold-storage hardware wallets for core company reserves and separate them entirely from development machines.
Run potential interview setups or client files in an isolated virtual machine or secondary device.

If you or your Web3 company have suffered a breach via trojanized applications, acting swiftly to secure evidence and engage law enforcement is essential.

APS Law assists technology enterprises, founders, and professionals across Mumbai, Thane, and Mira Road in navigating cybercrime litigation, emergency police representations, and electronic evidence preservation under the BNSS and BSA.

Contact APS Law today to request an initial consultation with our cyber law practice.