#FactCheck-2022 Video of Argentina’s FIFA World Cup Victory Celebrations Falsely Shared as Crowd at Rahul Gandhi’s ‘Chalo Delhi’ Rally

A word rooted in medical terminology keeps getting mistaken for a word rooted in technology, and that confusion is not just semantic. On 6 August 2026, it sat at the heart of a case where police in Uttar Pradesh reportedly treated the absence of WhatsApp chats, call recordings, and social media material as grounds to disbelieve a sexual assault complaint altogether, before the Allahabad High Court intervened. For an organisation working at the intersection of digital literacy and public safety, this case is less a story about a legal term and more a case study in how assumptions about digital evidence, when left unchecked, can become a barrier to justice rather than a tool for it. "Digital" here refers to a finger, not a device, and the gap between what police expected and what the law actually required is exactly where this case becomes instructive. Digital rape has nothing to do with the internet. Digit simply means finger, and the word describes non-consensual penetration by a finger, thumb, toe, or similar body part or object. That basic clarification matters because the same investigating officers who were expected to know the law also appear to have leaned on a mistaken evidentiary standard, one where a complaint without a digital trail was treated as a complaint without merit. The judgment that followed says as much about how the criminal justice system treats sexual assault complaints, and how it treats digital evidence, as it does about legal terminology.

The case, in brief

The matter is Arpit Gupta v. State of U.P. and 2 others, 2026 LiveLaw (AB) 571, neutral citation 2026:AHC:168404-DB, decided by a Division Bench of Justice Chandra Dhari Singh and Justice Tarun Saxena. Arpit Gupta, the owner of a Noida based real estate firm, Parit Associates (OPC) Private Limited, approached the High Court under Article 226 of the Constitution seeking to quash an FIR registered against him at Wave City police station, Ghaziabad, alleging rape, sexual harassment, and criminal intimidation. The complainant, a former employee of Gupta's company, alleged sustained workplace sexual harassment culminating in an act legally categorised as digital penetration, along with subsequent threats and intimidation. She resigned in April 2026. What followed procedurally is where the case becomes significant: Gupta filed a separate extortion complaint against her, she was arrested and later released on bail, and only after that sequence did she attempt to formally report the sexual assault, a report the police initially declined to register.

What followed complicates the picture considerably, and is central to why the case reached the High Court at all. On 14 April 2026, Gupta filed his own FIR against the complainant alleging extortion, claiming she had demanded 10 crore rupees from him. She was arrested in connection with that case and secured bail on 21 May 2026.  After her release, she attempted to register her own complaint of sexual assault, but police at Wave City station declined to register an FIR. A written complaint dated 7 July 2026 addressed directly to the Commissioner of Police, Ghaziabad, also produced no result. The police investigating officer's report, dated 16 July 2026, went further still, terming her allegations false and characterising the sexual assault complaint as a retaliatory counter-blast to Gupta's extortion case, citing in particular the absence of supporting electronic material such as WhatsApp chats, call recordings, or social media evidence. Only after she approached a Magistrate under Section 173(4) of the Bharatiya Nagarik Suraksha Sanhita, 2023, did the FIR finally get registered, by Magisterial order dated 20 July 2026.

The legal terminology: what "digital rape" actually means under BNS

Section 63 of the Bharatiya Nyaya Sanhita, 2023, which replaced Section 375 of the erstwhile Indian Penal Code, defines rape. Clause (b) of Section 63 extends that definition to cover non-penile penetrative acts, specifically insertion, to any extent, of any object or body part other than the penis into specified parts of a woman's body, done without her consent or against her will, subject to the circumstances of absent consent set out in the section. Digital penetration, meaning penetration by finger or thumb, falls squarely within this clause. There is no standalone offence in the BNS titled "digital rape"; the term is a widely used medico-legal shorthand, not a separate statutory category, and the offence itself is prosecuted and punished as rape under Section 64 BNS, which prescribes the punishment provisions. In this particular case, the FIR reportedly also invoked Sections 74, 75(2), and 76 BNS, provisions dealing with assault or use of criminal force with intent to outrage modesty, sexual harassment by a person in a position of authority, and related offences, alongside Section 351(3) BNS concerning criminal intimidation.

CyberPeace View

This is where the case circles back to the concern raised at the outset. The most instructive part of this judgment for the wider public may not be the definition of digital rape at all, but the police's original insistence on WhatsApp chats and call recordings before treating the complaint as credible. That reflex, a growing habit of associating the credibility of any complaint with the existence of a corresponding digital trail, reflects a wider and increasingly common misunderstanding about how evidence actually works in criminal law. Not every offence leaves an electronic footprint, and sexual assault, by its nature, frequently occurs without any accompanying digital record at all. Treating the absence of a chat log or a recording as evidence of falsehood inverts the legal presumption entirely, and risks turning digital literacy gaps within law enforcement into a structural barrier for genuine complainants who have no messages to produce because none were ever exchanged. As India's criminal justice system increasingly interacts with digital evidence, this case is a useful reminder that digital forensics should supplement an investigation, never gatekeep its starting point.

There is a genuinely technology rooted counterpart to this terminology confusion worth flagging, and it sits at the opposite end of the spectrum from where this case began. While "digital rape" has nothing to do with computers, "virtual rape" very much does, and it is an emerging harm India's legal framework is still catching up to. In January 2024, British police opened what was reported as the first investigation of its kind after a minor's avatar was allegedly gang assaulted by other avatars on Meta's metaverse platform, and similar incidents, avatars groped or sexually harassed within minutes of entering platforms like Horizon Worlds, have been documented repeatedly since, including a widely reported case involving psychotherapist Nina Jane Patel as far back as 2021. These incidents involve no physical contact whatsoever, yet researchers and legal scholars studying virtual reality note that immersive VR environments are specifically engineered to create a sense of embodiment, where the brain processes an avatar's violation as something closer to a real bodily experience than a typical online interaction, producing genuine trauma responses in victims. India's legal position here remains only partially settled. The POCSO Act's coverage of non-contact sexual abuse of minors likely extends to avatar based assaults on children, but adult victims of virtual sexual violence in India currently have no clearly dedicated statutory provision, leaving prosecutors to stretch existing harassment and outraging modesty provisions, originally drafted for a physical world, onto a form of harm the legislature has not yet explicitly addressed. As metaverse and VR platforms grow their user base in India, that gap is one worth closing before, rather than after, a case forces the question, much as this one forced the question of how police ought to treat digital evidence.

Conclusion

Two lessons run through this judgment. First, that the law's protection of bodily autonomy extends well beyond narrow, traditional definitions of penetration, a principle Section 63(b) BNS makes explicit. Second, that a complainant reporting a cognizable offence cannot be made to investigate her own case before the police will even open a file. FIR registration is not conviction, and conviction requires investigation, evidence, and trial to follow. What this case asks of the system is simpler than any of that: register the complaint, then do the work of finding out what happened.

References

1. https://www.barandbench.com/news/digital-rape-allahabad-hc-orders-inquiry-against-senior-ghaziabad-police-officers-for-not-filing-fir
2. https://www.livelaw.in/high-court/allahabad-high-court/allahabad-hc-police-cant-refuse-fir-sexual-complaint-non-production-evidence-545374

‍

Executive Summary:

A viral video that has gone viral is purportedly of mass cheating during the UPSC Civil Services Exam conducted in Uttar Pradesh. This video claims to show students being filmed cheating by copying answers. But, when we  did a thorough research, it was noted that the incident happened during an LLB exam, not the UPSC Civil Services Exam. This is a representation of misleading content being shared to promote misinformation.

Claim: 

‍

Mass cheating took place during the UPSC Civil Services Exam in Uttar Pradesh, as shown in a viral video.

‍

‍

Fact Check:

Upon careful verification, it has been established that the viral video being circulated does not depict the UPSC Civil Services Examination, but rather an incident of mass cheating during an LLB examination. Reputable media outlets, including Zee News and India Today, have confirmed that the footage is from a law exam and is unrelated to the UPSC.

The video in question was reportedly live-streamed by one of the LLB students, held in February 2024  at City Law College in Lakshbar Bajha, located in the Safdarganj area of Barabanki, Uttar Pradesh.

The misleading attempt to associate this footage with the highly esteemed Civil Services Examination is not only factually incorrect but also unfairly casts doubt on a process that is known for its rigorous supervision and strict security protocols. It is crucial to verify the authenticity and context of such content before disseminating it, in order to uphold the integrity of our institutions and prevent unnecessary public concern.

‍

‍

Conclusion:

‍

The viral video purportedly showing mass cheating during the UPSC Civil Services Examination in Uttar Pradesh is misleading and not genuine. Upon verification, the footage has been found to be from an LLB examination, not related to the UPSC in any manner. Spreading such misinformation not only undermines the credibility of a trusted examination system but also creates unwarranted panic among aspirants and the public. It is imperative to verify the authenticity of such claims before sharing them on social media platforms. Responsible dissemination of information is crucial to maintaining trust and integrity in public institutions.

• Claim: A viral video shows UPSC candidates copying answers.
• Claimed On: Social Media
• Fact Check: False and Misleading

Introduction

Recently the attackers employed the CVE-2017-0199 vulnerability in Microsoft Office to deliver a fileless form of the Remcos RAT. The Remcos RAT makes the attacker have full control of the systems that have been infected by this malware. This research will give a detailed technical description of the identified vulnerability, attack vector, and tactics together with the practical steps to counter the identified risks.

The Targeted Malware: Remcos RAT

Remcos RAT (Remote Control & Surveillance) is a commercially available remote access tool designed for legitimate administrative use. However, it has been widely adopted by cybercriminals for its stealth and extensive control capabilities, enabling:

• System control and monitoring
• Keylogging
• Data exfiltration
• Execution of arbitrary commands

The fileless variant utilised in this campaign makes detection even more challenging by running entirely in system memory, leaving minimal forensic traces.

Attack Vector: Phishing with Malicious Excel Attachments

The phishing email will be sent which appears as legitimate business communication, such as a purchase order or invoice. This email contains an Excel attachment that is weaponized to exploit the CVE-2017-0199 vulnerability.

Technical Analysis: CVE-2017-0199 Exploitation

Vulnerability Assessment

• CVE-2017-0199 is a Remote Code Execution (RCE) vulnerability in Microsoft Office which uses Object Linking and Embedding (OLE) objects.
• Affected Components:some text
  • Microsoft Word
  • Microsoft Excel
  • WordPad
• CVSS Score: 7.8 (High Severity)

Mechanism of Exploitation

The vulnerability enables attackers to craft a malicious document when opened, it fetches and executes an external payload via an HTML Application (HTA) file. The execution process occurs without requiring user interaction beyond opening the document.

Detailed Exploitation Steps

1. Phishing Email and Malicious Document some text
   • The email contains an Excel file designed to make use of CVE-2017-0199.
   • When the email gets opened, the document automatically connects to a remote server (e.g., 192.3.220[.]22) to download an HTA file (cookienetbookinetcache.hta).
2. Execution via mshta.exe some text
   • The downloaded HTA file is executed using mshta.exe, a legitimate Windows process for running HTML Applications.
   • This execution is seamless and does not prompt the user, making the attack stealthy.
3. Multi-Layer Obfuscation some text
   • The HTA file is wrapped in several layers of scripting, including: some text
     • JavaScript
     • VBScript
     • PowerShell
   • This obfuscation helps evade static analysis by traditional antivirus solutions.
4. Fileless Payload Deployment some text
   • The downloaded executable leverages process hollowing to inject malicious code into legitimate system processes.
   • The Remcos RAT payload is loaded directly into memory, avoiding the creation of files on disk.

Fileless Malware Techniques

1. Process Hollowing
The attack replaces the memory of a legitimate process (e.g., explorer.exe) with the malicious Remcos RAT payload. This allows the malware to:

• Evade detection by blending into normal system activity.
• Run with the privileges of the hijacked process.

2. Anti-Analysis Techniques

• Anti-Debugging: Detects the presence of debugging tools and terminates malicious processes if found.
• Anti-VM and Sandbox Evasion: Ensures execution only on real systems to avoid detection during security analysis.

3. In-Memory Execution

• By running entirely in system memory, the malware avoids leaving artifacts on the disk, making forensic analysis and detection more challenging.

Capabilities of Remcos RAT

Once deployed, Remcos RAT provides attackers with a comprehensive suite of functionalities, including:

• Data Exfiltration: some text
  • Stealing system information, files, and credentials.
• Remote Execution: some text
  • Running arbitrary commands, scripts, and additional payloads.
• Surveillance: some text
  • Enabling the camera and microphone.
  • Capturing screen activity and clipboard contents.
• System Manipulation: some text
  • Modifying Windows Registry entries.
  • Controlling system services and processes.
  • Disabling user input devices (keyboard and mouse).

Advanced Phishing Techniques in Parallel Campaigns

1. DocuSign Abuse
Attackers exploit legitimate DocuSign APIs to create authentic-looking phishing invoices. These invoices can trick users into authorising payments or signing malicious documents, bypassing traditional email security systems.

2. ZIP File Concatenation
By appending multiple ZIP archives into a single file, attackers exploit inconsistencies in how different tools handle these files. This allows them to embed malware that evades detection by certain archive managers.

Broader Implications of Fileless Malware

Fileless malware like Remcos RAT poses significant challenges:

• Detection Difficulties: Traditional signature-based antivirus systems struggle to detect fileless malware, as there are no static files to scan.
• Forensic Limitations: The lack of disk artifacts complicates post-incident analysis, making it harder to trace the attack's origin and scope.
• Increased Sophistication: These campaigns demonstrate the growing technical prowess of cybercriminals, leveraging legitimate tools and services for malicious purposes.

Mitigation Strategies

1. Patch Management some text
   • It is important to regularly update software to address known vulnerabilities like CVE-2017-0199. Microsoft released a patch for this vulnerability in April 2017.
2. Advanced Email Security some text
   • It is important to implement email filtering solutions that can detect phishing attempts, even those using legitimate services like DocuSign.
3. Endpoint Detection and Response (EDR)some text
   • Always use EDR solutions to monitor for suspicious behavior, such as unauthorized use of mshta.exe or process hollowing.
4. User Awareness and Training some text
   • Educate users about phishing techniques and the risks of opening unexpected attachments.
5. Behavioral Analysis some text
   • Deploy security solutions capable of detecting anomalous activity, even if no malicious files are present.

Conclusion

The attack via CVE-2017-0199 further led to the injection of a new fileless variant of Remcos RAT, proving how threats are getting more and more sophisticated. Thanks to the improved obfuscation and the lack of files, the attackers eliminate all traditional antiviral protection and gain full control over the infected computers. It is real and organisations have to make sure that they apply patches on time, that they build better technologies for detection and that the users themselves are more wary of the threats.

References

• Fortinet FortiGuard Labs: Analysis by Xiaopeng Zhang
• Perception Point: Research on ZIP File Concatenation
• Wallarm: DocuSign Phishing Analysis
• Microsoft Security Advisory: CVE-2017-0199

‍