Naidu, Rijiju, Sitharaman fall victim to WhatsApp impersonation, probe shows IP addresses of Pakistan, Hong Kong

Last year too, a similar FIR was lodged with the Intelligence Fusion and Strategic Operations unit of the Special Cell, an officer said.

An officer said investigation revealed that the SIM cards used were obtained from West Bengal, Odisha, Punjab, Haryana, Delhi, Gujarat and Maharashtra. “Details of WhatsApp accounts involved in offences were obtained, which revealed IP addresses of Nigeria, Hong Kong and Pakistan. IP addresses were analysed on an open source tool and it was found no VPN or proxy was used,” the officer said.

Since 2022, Delhi Police has registered cases after suspects pretended to be Union Petroleum and Natural Gas Minister Hardeep Singh Puri, former Agriculture Minister Narendra Singh Tomar, Union Labour Minister Mansukh Mandaviya, Delhi L-G VK Saxena, Lok Sabha Speaker Om Birla, former CJI N V Ramana, former Attorney General of India KK Venugopal, Delhi HC Judge Justice Chandra Dhari Singh, Defence Secretary Giridhar Aramane, former Union Home Secretary Rajiv Mehrishi and Delhi Police Commissioner Sanjay Arora.

An officer said the suspect creates a WhatsApp account with a picture of the target from social media or the Internet.

“Prior to that, the accused sniffs OTPs of Indian phone numbers either using SMS forwarding apps or purchases them from Telegram groups. During analysis of phone numbers of some suspects, whose phone numbers were used in this offence, an SMS forwarding app, ‘Thermal Camera app’, was found installed,” the officer said. According to the police, Thermal Camera app is a malicious app that performs SMS bombing — an user’s number is flooded with messages or even OTP calls in a short span to harass an user and disrupt device’s normal functioning — on registered number on the app to send OTP of Gmail, WhatsApp and Facebook.

“After opening a fake account (using target’s details), suspect sends messages to those who know the target, asking them to purchase e-gift cards from e-commerce sites on pretext of emergency and ask them to share it. Some of them buy and send them to the suspect, who sells them on Paxful or Telegram,” an officer said.