#FactCheck-Bangladesh Video Falsely Shared as Security Forces Action During West Bengal Elections 2026
Executive Summary
As West Bengal heads for vote counting on May 4, 2026, following the second phase of Assembly polling held on April 29, a video is being widely shared on social media. The clip shows security personnel baton-charging civilians, with users claiming it depicts force being used during the West Bengal Assembly Elections 2026. Research by CyberPeace Research Wing found that the viral claim is misleading. The video is actually from Bangladesh and is being falsely linked to the West Bengal elections to spread confusion.
Claim
A Facebook user named “Adv Mohd Salman” shared the clip on April 29, 2026, using Bengal-related hashtags and claiming that voters standing in line were beaten to influence the election outcome. The post alleged that free and fair voting rights were being suppressed.
Fact Check
To verify the claim, we closely examined the viral video. A vehicle visible in the footage had a registration number written in a non-Hindi script. Using Google Lens reverse image search, we found a matching image uploaded on Alamy on December 30, 2018. The image showed a military vehicle with the same script and registration style seen in the viral clip.
According to the description on the platform, the image was taken in Dhaka during Bangladesh’s national elections and showed Bangladeshi army personnel moving through a street near a polling station. This confirms that the viral footage is not related to the 2026 West Bengal Assembly elections.
Conclusion
Our research confirms that the video showing security personnel baton-charging civilians is from Bangladesh, not West Bengal. It is being falsely shared as footage from the 2026 West Bengal Assembly elections to mislead users.
Related Blogs
Introduction
A zero-click cyber attack solely relies on software and hardware flaws, bypassing any human factor to infect a device and take control over its data. It is almost impossible to discover the attack and know that the device is hacked unless someone on your side is closely monitoring your network traffic data.
At Kaspersky, security analysts used their SIEM solution KUMA to monitor their corporate WiFi network traffic and discovered this mysterious attack. They took necessary actions to investigate it and even went a step further to dive right into the action and uncover the entire attack chain.
A few months ago, Kaspersky shared their findings about this attack on iOS devices. They shared how these zero-click vulnerabilities were being exploited by the attackers and called this attack ‘Operation Triangulation’.
A zero-click exploit in the network
Kaspersky detected a zero-click attack on the iPhones of their colleagues while monitoring their corporate WiFi network traffic. They managed to get detailed information on all the stages of the attack by simply identifying a pattern in the domain names flowing through their network. Although the attackers were quite experienced, their mistakes helped Kaspersky detect critical vulnerabilities in all iOS devices.
The name-pattern
These previously unsuspected domains had a similar name-style which consisted of two names and ended with ‘.com’, such as ‘backuprabbit.com’ and ‘cloudsponcer.com’. They were used in pairs, one for an exportation process and the other served as a command and control server. These domains showed high outbound traffic, they were registered with NameCheap and protected with Cloudflare.
The network pattern
Each time a connection to these suspicious domains was made, it was preceded by an iMessage connection which indicated these domains are being accessed by iOS devices. It was observed that the devices connected to these domains, downloaded attachments, performed a few requests to a first level domain which was an exploitation framework server, then made regular connections with the second level domain which was a command and control server controlled by the attackers.
Getting more information
To get more information about the attack all the infected devices were collected and backed up after carefully informing the device owners. Although the attackers had managed to clean their artefacts, the backed up data was used to perform digital forensic procedures and find traces of the attacks. This helped Kaspersky to figure out how the infection might be taking place.
The attacker’s mistakes
The attackers deleted all the attachment files and exploits but did not delete the modified SMS attachment folder. That folder had no files left inside it. The attackers removed evidence from other databases as well, like the ‘SMS.db’ database, however another database called ‘datausage.sqlite’ was not sanitised.
The ‘datausage.sqlite’ database is the most important database when it comes to iOS forensics as its contents can be used to track applications and network usage. Upon examination of this database, a process logged as ‘BackupAgent’ was found to be making network connections at the same time the device was making connections to the suspicious domains.
The indicator of compromise
‘BackupAgent’ stood out in this scenario because although it is a legitimate binary, it has been deprecated since iOS4 and it should not have been making any network connections. This identified the ‘BackupAgent’ process as the first solid indicator of compromise in Operation Triangulation. The indicator is termed as- ‘Data usage by process BackupAgent’, and was used to determine if any specific device was infected.
Taking it a step ahead
The team at Kaspersky successfully identified the indicator of compromise and determined which devices were infected, but as the attackers were experienced enough to delete their payloads, they decided to set a trap and perform a man-in-the-middle attack. When they did, the attackers were unable to detect it.
The man-in the-middle attack
Kaspersky prepared a server with ‘WireGuard’ and ‘mitmproxy’. They installed root certificates on devices that could be used as targets for the attackers and routed all the network traffic to that server. They also developed a ‘Telegram’ bot to notify them about new infections as they decrypted the network traffic.
Setting up a bot proved to be an effective way of real time monitoring while modifying all the network packets on-the-fly with ‘mitmproxy’, this gave them unlimited power! Their trap was successful in capturing a payload sent by the attackers and it was analysed in detail.
The name was in the payload
The payload was an HTML page with obfuscator javascript which performed various code checks and canvas footprinting. It rendered a yellow triangle and calculated its hash value. This is why the operation was named Operation Triangulation.
The team at Kaspersky started cracking various layers of asymmetric cryptography with regular expressions. They patched the stages one-by-one on the fly to move the logic from each stage to ‘mitmproxy’ and finally implemented a 400 line ‘mitmproxy’ add-on. This add-on decrypted all the validators, exploits, spyware and additional modules.
The mystery
It is remarkable how Kaspersky detected the attack and identified multiple vulnerabilities, set up a trap to capture a payload and decrypted it completely. They shared all their findings with the device manufacturer and Apple responded by sending out a security patch update addressing four zero-day vulnerabilities.
A zero-click vulnerability
Traditionally any spyware relies on the user to to click on a compromised link or file to initiate the infection. However a zero-click vulnerability is a specific flaw in the device software or hardware that the attacker can use to infect the device without the need for a click or tap from the user.
The vulnerabilities identified
- Tricky Font Flaw (CVE-2023-41990): A clandestine method involving the manipulation of font rendering on iPhones, akin to a secret code deciphered by the attackers.Apple swiftly addressed this vulnerability in versions iOS 15.7.8 and iOS 16.3.
- Kernel Trick (CVE-2023-32434): Exploiting a hidden language understood only by the iPhone's core, the attackers successfully compromised the kernel's integrity.Apple responded with fixes implemented in iOS 15.7.7, iOS 15.8, and iOS 16.5.1.
- Web Sneakiness (CVE-2023-32435): Leveraging a clever ploy in the interpretation of web content by iPhones, the attackers manipulated the device's behaviour.Apple addressed this vulnerability in iOS 15.7.7 and iOS 16.5.1.
- Kernel Key (CVE-2023-38606): The pinnacle of the operation, the attackers discovered a covert method to tamper with the iPhone's core, the kernel.Apple responded with a fix introduced in iOS 16.6, thwarting the intrusion into the most secure facets of the iPhone
Still, how these attackers were able to find this critical vulnerability in a device which stands out for it’s security features is still unknown.
CyberPeace Advisory
Zero-click attacks are a real threat, but you can defend yourself. Being aware of the risks and taking proactive steps can significantly reduce vulnerability. Regularly installing the latest updates for your operating system, apps, and firmware helps patch vulnerabilities before attackers can exploit them.
- Keep your software updated as they contain crucial security patches that plug vulnerabilities before attackers can exploit them.
- Use security software to actively scan for suspicious activity and malicious code, acting as a first line of defence against zero-click intrusions.
- Be cautious with unsolicited messages if the offer seems too good to be true or the link appears suspicious as it can contain malware that can infect your device.
- Disable automatic previews as it can potentially trigger malicious code hidden within the content.
- Be mindful of what you install and avoid unverified apps and pirated software, as they can be Trojan horses laden with malware.
- Stay informed about the latest threats and updates by following reliable news sources and security blogs to stay ahead of the curve, recognize potential zero-click scams and adjust your behaviour accordingly.
Check out our (advisory report)[add report link] to get in depth information.
Conclusion
Operation Triangulation stands as a testament to the continuous cat-and-mouse game between cybercriminals and tech giants. While the covert spy mission showcased the vulnerabilities present in earlier iPhone versions, Apple's prompt response underscores the commitment to user security. As the digital landscape evolves, vigilance, timely updates, and collaborative efforts remain essential in safeguarding against unforeseen cyber threats.
References:
- Operation Triangulation: iOS devices targeted with previously unknown malware | Securelist, 1 June, 2023
- Operation Triangulation: The last (hardware) mystery | Securelist, 27 December, 2023.
- 37C3 - Operation Triangulation: What You Get When Attack iPhones of Researchers (youtube.com), 29 December,2023
Executive Summary
A letter circulating on social media falsely claims that Prime Minister Narendra Modi has resigned from his post. CyberPeace Research Wing's research found the claim to be false. Our research confirmed that the viral letter is fabricated and is being shared with a misleading claim. AI detection tools also indicate that the document is highly likely to have been generated using artificial intelligence.
Claim
An Instagram user shared the viral letter on July 29, 2026, claiming that Prime Minister Narendra Modi had resigned from office.
The post link, archived link, and screenshot are provided below:
https://www.facebook.com/photo/?fbid=2108984893363522&set=a.785246212404070
https://ghostarchive.org/archive/aHXTq
Fact Check
To verify the claim, we conducted a keyword search on Google. However, we found no credible media reports supporting the claim that Prime Minister Modi had resigned.
We then visited the official website of the Prime Minister's Office (PMO India). The website contained no announcement, press release, or official information confirming the purported resignation.
https://www.pmindia.gov.in/en/
As part of our research , we also reviewed the official X (formerly Twitter) account of PMO India. We found no post or statement related to the viral claim.
Finally, we analyzed the viral letter using the AI detection tool Sightengine AI. The analysis indicated that the document is 99% likely to be AI-generated.
To further verify the findings, we also scanned the letter using AI or Not. According to the tool's analysis, the document is 64% likely to be AI-generated.
Conclusion
The claim that Prime Minister Narendra Modi has resigned is false. No credible media organization or official government source has reported such a development. Furthermore, AI detection tools strongly suggest that the viral resignation letter was generated using artificial intelligence and is being circulated with a false claim.
Executive Summary:
A video showing a convoy of soldiers travelling on motorcycles is being widely shared on social media with the claim that the personnel were heading towards Delhi’s Jantar Mantar to support the ongoing protest led by the Cockroach Janata Party (CJP). CyberPeace Research Wing’s research found the claim to be false. The viral video is not related to the CJP protest at Jantar Mantar. The footage predates the ongoing demonstration and is being circulated with a misleading claim.
Claim:
A social media user shared the viral video claiming that soldiers were travelling towards Delhi’s Jantar Mantar to support the youth participating in the CJP protest over issues related to the country’s education system. The post claimed that the soldiers were joining the protest to raise their voice on issues concerning the nation, youth, and their future.
https://x.com/RoflGandhee/status/2079986496556204066?s=20
A reverse image search using Google Lens led the Desk to a video uploaded on a YouTube channel named Commando Journey. Upon comparison, the Desk found that the YouTube video contained the same visuals as the viral video under research. Further verification of the video details revealed that the footage predates the ongoing Cockroach Janata Party (CJP) protest at Jantar Mantar. The protest, which began in June 2026, has been demanding the resignation of Union Education Minister Dharmendra Pradhan over alleged irregularities in examinations. The video was uploaded on the YouTube channel in February 2026, several months before the CJP protest began, confirming that it has been falsely linked to the recent demonstration.
https://www.youtube.com/shorts/cMvai580gdo
As part of the next phase of the research, the Desk reviewed several other videos uploaded on the same YouTube channel. During the analysis, the Desk identified multiple videos featuring visuals matching those seen in the viral clip. However, these videos were also uploaded before the CJP protest in Delhi, with one of the videos dating back to October 2025.
https://www.youtube.com/shorts/7eDc9TqOpzM
Conclusion
While the Desk could not independently verify the exact origin and context of the video, the research established that the footage predates the CJP protest and has been falsely linked to the demonstration. Based on the findings, the Desk concluded that the video shared on social media does not show soldiers travelling to Delhi’s Jantar Mantar to support the Cockroach Janata Party (CJP) protest. The footage is unrelated to the ongoing protest and has been circulated with a misleading claim.
