India Raises the Alarm -How AI is rewiring the Cyber Threat Landscape
Introduction
The advent of frontier AI has significantly widened the range of actors who can launch cyberattacks, extending beyond state actors with immense capabilities or organized professional cybercriminal rings. In its most critical advisory, CIAD-2026-0020, titled "Defending against frontier AI-driven cyber risks," which was released on April 26, 2026, the Indian Computer Emergency Response Team (CERT-In) officially stated that AI can now carry out autonomous cyber activities of unprecedented scale and speed. The advisory highlights that these frontier AI models can perform automated reconnaissance, phishing, malware creation, vulnerability identification, and social engineering with minimal human involvement, thus "lowering the barrier to orchestrating complex cyber attacks." The risks that such AI models pose are not restricted to state actors and corporate entities anymore and also extend to MSMEs, public organizations, and individuals.
India’s Escalating Cybercrisis
The Indian digital economy has been developing at a very fast pace, but the same cannot be said about its cybersecurity. Having a base of over 850 million internet users and a digital payment sector that records a massive 22,495 crore in monthly transaction volumes, coupled with the fastest-growing cloud sector in the world, India continues to remain a lucrative prey for cybercriminals. There were over 265 million attempts reported in the last year, 2025, alone, where close to 46% of all incidents detected were in enterprises with fewer than 1,000 employees, a very grave reality for MSMEs. MHA confirmed there were 28.15 lakh reported cybercrime complaints in 2025 as compared to 2024, with a jump of 24%.
In this worsening environment the advisory is a breakthrough in Indian cyber governance. Where previously advisories covered only conventional threats like phishing and malware, the new warning names frontier agentic AI systems as autonomous multipliers of threats, capable of conducting operations at scale and speed with significantly reduced human oversight.
What is “Frontier AI” and why does it matter?
CERT-In’s decision to adopt the term "Frontier AI" is deliberate and meaningful. The advisory’s scope is a new category of agentic AI, which moves well beyond traditional chatbot-style AI, having the capacity to reason, plan, perform multiple actions in a single task autonomously, and carry out complicated tasks with minimal or no human guidance. CERT-In highlights that these tools now possess the capabilities that were "previously carried out by a coordinated team of skilled cybersecurity professionals." The advisory clearly flags the risk that these advanced models have the capability to generate malicious code, conduct network scans, probe systems for vulnerabilities, and even orchestrate intricate multi-stage cyberattacks in a single session. Their capacity to analyse a vast number of source code libraries to identify vulnerabilities, even unknown zero-day ones, and then develop proof-of-concept exploits at high speed. This means that the historical lead time to turn a vulnerability discovery into an exploit tool has reduced from weeks to just hours.
Six Core Threat Vectors identified by CERT-In
- AI-driven Automatic Zero-Day Discovery: AI-based solutions discover zero-day vulnerabilities and automatically create exploits in minutes, reducing the time taken by defenders.
- AI-driven Autonomous Reconnaissance: AI-driven agents scan cloud infra, APIs, and enterprise networks and outline attack vectors.
- AI-driven phishing & deepfakes: Multilingual, highly targeted phishing emails, deepfake audio, and deepfake voice/video calls bring sophistication to social engineering.
- Deepfake Financial Fraud: AI creates deepfake executives for high-value money transfers. For example, reports have indicated crore-level fund loss cases in India.
- AI-powered Autonomous Attack Chains: Advanced AI models are able to automatically perform multiple malicious stages like privilege escalation, lateral movement, data exfiltration, and data extraction.
- Cascading failures of interconnected systems: A single AI-supported security breach can have catastrophic domino effects on connected digital systems and critical infrastructures.
Why are MSMEs a target?
CERT-In’s warning is specifically targeted toward the weakness of the Indian MSMEs. Contributing almost 30% to India's GDP and employing over 110 million individuals, most MSMEs have failed to adequately prepare themselves against contemporary cyber threats. While a large corporation would have a full-time cybersecurity team, a security operation centre, and frequent vulnerability assessments, the majority of MSMEs lack such infrastructure due to budget constraints, out-of-date software, etc. This lack of security has proved to be quite disadvantageous for smaller businesses, as India was identified as one of the top global targets for cyberattacks, where approximately 46% of the total breaches worldwide targeted organizations having fewer than 1000 employees. The advisory claims that frontier AI systems have significantly increased the threats, for the skills necessary to carry out advanced cyberattacks have dramatically decreased. Ransomware, phishing and data exfiltration can be executed by even unsophisticated attackers. The aftermath could result in critical financial, operational, and compliance impact on these MSMEs.
The Global Context
These developments seem to validate CERT-In's warning about threats posed by frontier AI. In its 2026 State of Cybersecurity Report, ISACA listed AI-related threats as the top concern of cybersecurity professionals; 61% of those surveyed reported generative AI/large language models as the top technology trend impacting cyber risk. Worryingly, in 2026 only 7% were confident in their organizations' defenses against ransomware. Check Point Software's Cyber Security Report 2026 corroborates this; in 2025 the report stated that in a single year, the trend of combined social engineering-based campaigns with automated operational execution has risen considerably. In all phases of the lifecycle of a cyberattack reconnaissance, social engineering, and tactical decision-making AI is being applied. KPMG is warning of deepfake-enabled fraud now "spreading at a faster rate than that experienced at the beginning of the phishing era, which is currently still the leading type of attack in the world."
CERT-In Recommendations
For Large Organisations:
The use of security monitoring, threat detection, and log analysis should be increased.
DDoS protection systems and multi-factor authentication (MFA) should be implemented on all internet-facing devices and assets.
Critical security patches should be installed within 24 hours of release.
Old VPN and remote-access infrastructure should be updated or replaced.
AI-driven cyber drills and incident response simulations should be regularly performed.
For MSMEs:
Software and security updates should be automatically enabled on all devices and systems.
MFA should be enabled on organisational accounts and sensitive platforms.
MSMEs should utilize MSSPs for specialized support and monitoring.
Detailed inventories of IT assets and system logs should be kept for fast incident response.
Staff should be educated about identifying AI-generated phishing, deepfakes, and scams.
For Individuals:
Independent communication channels should be used to verify any dubious message or money request.
Software from unverified sources or unauthorised channels should not be downloaded.
The use of strong and unique passwords along with MFA wherever possible should be enforced.
From Advisory to Action
The May 2026 cybersecurity road map released by CERT-In signals a departure from identification of threats to enabling operations against frontier AI-led cyber threat landscapes. This initiative builds on their April advice and delineates a clearly articulated three-phase roadmap comprising immediate cyber readiness, AI governance controls, and deep integration of AI-driven defenses. It also provides for the establishment of a focused AI Cyber Defense Center and various multisector governance provisions. A prominent area is the increased threat of impersonation via deepfakes, and companies are encouraged to institute executive verification procedures prior to approving high-value transactions. The framework also emphasizes the establishment of an AI asset register requiring formal accounting and governance of all AI systems utilized in an enterprise.
Meanwhile, CERT-In also recognizes the twin-use nature of frontier AI: for every threat, the same technology can bolster security with automated threat detection, phishing, and log analysis in real time.
However, the deployment of state-of-the-art defenses is uneven, especially with MSMEs, where there isn’t the requisite domain expertise and funding for this infrastructure. Accordingly, the road map puts the emphasis on immediate and stronger cyber hygiene, compulsory incident reporting, enhancing AI literacy, and proper implementation of the Digital Personal Data Protection Act for long-term security investment and resilience.
Conclusion
The CERT-In advisory CIAD-2026-0020 signifies a vital acknowledgment of AI's transformational impact on the cybersecurity ecosystem. Capabilities formerly exclusive to elite state actors are being deployed by low-skilled users, leveraging state-of-the-art frontier AI tools. India’s MSMEs, enterprises, and digital citizens are experiencing a rapidly accelerating threat milieu. In this context, the CERT-In advisory and the ensuing blueprint can no longer be dismissed as ordinary government pronouncements but as critical operational imperatives. It is the country’s ability over the next few years to shore up its collective cyber resilience to the ever-increasing scale and sophistication of AI-powered attacks that will prove crucial.
References:
- https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0020
- https://www.zeebiz.com/technology/news-cert-in-flags-high-severity-ai-cyber-risks-amid-claude-mythos-concerns-394448
- https://www.business-standard.com/technology/tech-news/cert-in-warning-ai-scams-frontier-models-mythos-gpt-5-5-what-it-means-126042800988_1.html
- https://www.businesswire.com/news/home/20251020612551/en/
- https://corporate.indiamart.com/2025/07/29/staying-ahead-of-cyber-threats/
- https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2025/deepfakes-real-threat.pdf
Related Blogs
Introduction
The Kumbh Mela is known worldwide as India's most significant pilgrimage and has earned a place on the UNESCO Intangible Cultural Heritage of Humanity list in 2017. This year, the Maha Kumbh will be held in Prayagraj, Uttar Pradesh, with 40 crore devotees from all over the world expected to attend this momentous event from January 13th to 26th February 2025. As the world embraces the blessings of digitalisation, people are increasingly relying on the Internet for arranging their travel, booking rooms, and securing accommodations for this grand spiritual journey.
However, amidst this digital age, where the conveniences offered are manifold, there also lurks the shadow of deceit. Cybercriminals are finding innovative ways to entrap innocent individuals. Fraudulent activities are on the rise, with wrongdoers operating fake websites that promise secure bookings for cottages, tents, and other accommodations for the Mahakumbh event. Like the deceptive mirage that the desert traveller may mistakenly believe to be an oasis, these malicious sites lure pilgrims with the false hope of easy arrangements, only to exploit their trust and commit malicious cyber fraudulent activities.
Policy and Preventive Measures Taken by Government
This year, the government has taken steps to utilise digitalisation services to enhance the experience of devotees, blending innovation with tradition. However, considering the rise in cyber scams, a dedicated cyber police station has also been established at Maha Kumbh 2025 to address threats such as the misuse of AI, the dark web, and social media platforms. This initiative aims to protect devotees from potential scams.
To strengthen safety measures, a special team of selected officers from across the state has been deployed in Mahakumbh Nagar, Prayagraj, to provide cybersecurity and ensure the safety of pilgrims. A dedicated cyber police station or digital police station will ensure round-the-clock monitoring of cyberspace.
The cybersecurity team has already identified 44 suspicious websites and initiated action against them. To further safeguard devotees attending Maha Kumbh 2025, a large-scale awareness campaign is being conducted to educate users about potential cyber threats.
The Role of Digital Discipline in Navigating the Uncharted Waters of the Internet
As the Yajurveda (ancient Vedic scriptures of Hinduism) reminds us ‘सत्यं चानृतं च सत्यं अभवत्, यदेतत् तपसा तप्यताम्।’. This learning translates into English as "Truth and falsehood are both present, yet truth is purified through intense discipline”. The Mahakumbh is a confluence not just of rivers but of faith and humanity's eternal quest for truth (Satyam). In the digital age, this vigilance extends to protecting ourselves from cyber frauds and scams that exploit the sanctity of occasions like the Mahakumbh. Just as devotees seek purity through holy rituals, we must also embrace Digital Discipline to navigate the confluence of tradition and technology safely.
Here are some Digital Discipline best practices you must follow:
- Be cautious of fake websites, fraudulent travel agencies, and scam bookings. Always verify legitimacy before engaging in any transactions.
- Stay alert for fake donation requests and only contribute to verified organizations.
- Be aware of any mis/disinformation and implausible claims surrounding the Mahakumbh event and verify it from authenticated sources. The official website of Mahakumbh is https://kumbh.gov.in.
- To report any cybercrime or issue, you can report it on the National Cyber Crime Reporting Portal at https://cybercrime.gov.in/, equipped with a 24x7 helpline 1930 that serves as a powerful resource available to the victims of cybercrimes to report their cases.
Conclusion
Netizens worldwide must prioritise Digital Discipline to ensure they are safeguarded from the snares of these cyber miscreants, so that they may safely and joyfully embark on their journey to the Maha Kumbh and receive divine blessings and purity of purpose through the experience.
References
- https://www.deccanherald.com/india/uttar-pradesh/up-police-gets-on-its-toes-to-ensure-cyber-safe-maha-kumbh-3335911
- https://www.hindustantimes.com/cities/others/four-cyber-crooks-held-for-operating-fake-booking-websites-101735326388201.html
- https://www.indiatvnews.com/uttar-pradesh/maha-kumbh-2025-cyber-police-station-set-up-in-prayagraj-to-safeguard-devotees-from-online-frauds-in-city-preparation-security-other-details-2024-12-11-965745
- https://organiser.org/2024/12/12/268915/bharat/mahakumbh-2025-cyber-police-station-set-up-to-protect-devotees-from-ai-and-social-media-scammers/
- https://www.ptinews.com/story/national/maha-kumbh-56-cyber-warriors-deployed-to-safeguard-devotees-against-online-scams/2135062
.webp)
Introduction
In today's era, where the threat from the digital world is growing rapidly, good developments in the war against cybercrimes cannot be ignored when they do happen. The state, which was notorious for being one of the most notorious criminal states in the country concerning digital crimes, has brought about remarkable changes in the law and order situation in the country in the last few years. According to the most recent data released by the Union Ministry of Home Affairs, Assam recorded only 408 cybercrimes in the year 2024, while the figure for the previous year was 909, which means a decline of over 55% in one year. But what is even more notable about the feat is the fact that, on the other hand, the country as a whole witnessed a rise of nearly 18% in the cybercrimes recorded.
Assam's Cybercrime Journey
To understand where Assam is today can only achieve this by understanding how far it has come. In 2021, it was ranked the 5th highest state or union territory in India in the realm of cybercrime, with a staggering number of 4846 cases. The state kept the worrisome numbers continuing in the year 2022, as it ranked 9th with 1,733 cases before sliding down to 13th place in 2023 with 909 cases. However, the steep fall to a minuscule 408 cases in 2024 is an amazing narrative of how a state managed to completely eradicate the cybercrime infrastructure.
This is not a mere coincidence in statistics. This has proved to be a sustained, systematic operation by the law-enforcing agencies. Police sources say the decline is the result of consistent law enforcement action against cybercrime networks and the positive effect of awareness campaigns. Assam recorded 360 arrests under cybercrime-related offences and charge-sheeted 285 in the year 2024.
The National Picture: A Troubling Contrast
While the case of Assam is inspiring, the numbers on a pan-Indian level look bleak. India saw as many as 101,928 cybercrimes registered on its soil in the year 2024; a sharp rise from 2023, when 86,420 incidents had been reported. And it's not just in the number of cases that have seen an alarming rise; the economic implications are equally devastating. As many as 19.18 lakh complaints were lodged on the National Cyber Crime Reporting Portal in 2024. These complaints were an outcome of the financial losses to the tune of almost Rs 22,811.95 crore, according to a statement by the Home Ministry.
In 2024, the states that stood out at the top were Telangana (27,230), Karnataka (21,993), Uttar Pradesh (11,073), Maharashtra (9,922), and Bihar (6,380), among others. This clearly goes on to prove how the occurrences of cybercrime are not uniform across all states in the country due to various local and state-specific factors like the enforcement provided by state police forces, literacy levels of the general public, and the range of awareness campaigns carried out.
Even within Assam, the trend is not uniform, as almost every other Northeastern state has recorded a rise in cybercrimes this year, the figures being Arunachal Pradesh 24 to 78, Mizoram 31 to 50, Meghalaya 64 to 97, and Nagaland 2 to 14. It is only Tripura that saw a dip in reported cybercrimes, from 36 to 33. Considering these statistics, it becomes even more crucial to study and emulate Assam's success.
The Drivers and Disrupters of Cybercrime
It is in understanding how cybercrimes in Assam are committed that one might derive how these should be combatted. Of the 408 cases registered so far in 2024, 253 were registered for transmitting, or publishing, electronically, any obscene or sexually explicit material, and 115 cases were under computer-related offences. As for motive, they vary widely; 121 cases were registered out of revenge, 55 for fraud, 43 for extortion, and 42 for sexual exploitation. Sadly, out of 408 crimes reported so far in 2024, 196 victims are women, and 20 are children; in essence, the real impact is on society's most vulnerable.
This is a useful categorisation for the policymakers. It would not be beneficial if it were an all-encompassing strategy against cybercrimes when the motives and mechanisms behind them differ so widely. Customised campaigns educating women on cyberbullying, educating children on online security, and cautioning the public against online fraudulent schemes would be much more effective than general advice.
On the national front, significant investments have been made by the central government for developing cybercrime-fighting infrastructure. Since the I4C was established in 2018, the launch of NCRP in 2019 provides a reporting and coordination framework against cybercrimes, and it is reported that over 5,489 crore have been saved by freezing illegal transactions, stemming from over 17.88 lakh complaints, through these platforms. Over 9.42 lakh SIM cards and 263,248 International Mobile Equipment Identities (IMEI) numbers have been blocked due to involvement in cybercrime.
The Role of Awareness and Enforcement
The biggest, and perhaps most transferable, lesson learned from Assam is the importance of both enforcement and awareness. Alone, neither proves useful: an enforcement operation without public knowledge leaves the public at risk for the next offence, while a purely informational approach gives criminals the license to proceed. Assam seems to have a more pragmatic approach; at least the statistics support this notion.
As the most persistent weakness, cyber hygiene is still a critical issue for India's cybersecurity. The core problem is the limited public knowledge on the importance of safer online practices, and it has been one of the primary hurdles to reducing crimes online; in instances where crimes were committed and reported, insufficient processes and infrastructure remained challenges in their investigation. Therefore, institutional investment in resources such as local police cyber cells and national coordinating agencies is an integral component to overcoming these challenges.z
Conclusion
By decreasing the rate of cybercrime in Assam by 55%, the successful combination of vigorous prosecution, constant pressure to uphold the law, and thorough public awareness campaigns has demonstrated a viable solution to ever-increasing online threats throughout India. Assam presents an attainable blueprint to diminish cybercrime, although the criminals of this evolving landscape cannot be constrained by individual state borders. To successfully achieve an e-economy that thrives on security and trust, India must adapt and expand the same law enforcement and awareness campaign strategies.
References
- https://assamtribune.com/assam/assam-records-over-55-decline-in-cyber-crime-cases-in-2024-mha-1611895
- https://ddnews.gov.in/en/cybercrime-complaints-cross-19-lakh-in-2024-97-drop-in-spoofed-calls-post-new-measures/
- https://www.medianama.com/2025/08/223-india-cybercrime-500-percent-increase-2021-2024/
- https://statista.com/topics/5054/cyber-crime-in-india
- https://i4c.mha.gov.in
Introduction
In an era expounded by rapid communications and live coverage of global affairs, users often encounter misinformation continuously, and it has emerged as a huge challenge. Misinformation is false or inaccurate information, believed to be true, and shared without any intention to deceive. On the other hand, disinformation refers to false information that is intended to mislead, especially with set propaganda. It steadily affects all aspects of life and can even lead to a profound impact on geopolitics, international relations, wars, etc. When modern media announces “breaking news,” it captures attention and keeps viewers engaged. In the rush for television rating points, information may be circulated without proper fact-checking. This urgency can result in the spread of unverified claims and the elevation of irrelevant details, while truly important issues are overlooked. Such practices can distort public understanding and impact strategic political decisions.
Misinformation and Fake News in Recent History
The phenomenon of misinformation is not limited to isolated incidents but has become a recurring feature of political events around the globe. This business has increasingly become visible in recent political history, where it has not only sensationalised the general public but also affected international relations and democratic outcomes. For example, during Slovakia’s elections in 2023, the country experienced a major surge of online misinformation. Over 365,000 misleading posts were posted on social media platforms, majorly influencing public opinion and leading to challenges for voters. A lot of this content was amplified by political leaders. The media's rush to deliver content sometimes makes it easier for false narratives to dominate the public sphere, shaping voter opinions and undermining informed political discourse.
Current Geopolitical Interference by Misinformation
In the recent Hamas-Israel conflict, manipulated images and unverified reports complicated diplomacy. Such campaigns distort facts, complicate humanitarian responses, and escalate conflicts. This growing trend shows how misinformation now acts as a weapon of war, exploiting media urgency and undermining international stability.
Indo–Pak Conflict Exaggeration
The India-Pakistan conflict is a long-dragged and complex issue in South Asia. It has been continuously dragged from traditional to contemporary media. But in recent tensions and war situations media raised serious concerns about misinformation. Live media coverage can sometimes mislead the public with speculative information. The live coverage continuously addressed it as breaking news and escalated excitement and fear, distorting the reality on the ground. Moreover, the real-time reporting of sensitive military activities like mock drills, blackouts, troop movements, air strikes, etc., interfered with strategic operations. Such reporting may lead to obstructing decision-making processes and placing operational missions at risk. Later Defence Ministry called it out in one of their X posts. Such media-driven exaggeration causes mass hysteria, and eventually, emotional and patriotic sentiments are evoked.
Legal and Political Recommendations
The intersection of media urgency and national security may have serious geopolitical repercussions if not managed with legal and ethical restrictions. International Frameworks like UNESCO‘s Guidelines for regulating Digital Platforms, 2023, and the Digital Services Act, 2022, regulate and govern digital platforms.
Despite the existence of international and national guidelines, there remains an urgent need to strengthen cyber laws by imposing strict penalties and compensation mechanisms for the dissemination of unverified information. Media outlets must also refrain from indiscriminately labelling every report as “breaking news.” Since the modern media deals in digital data, the protection of strategic state movements should be regulated with checks and balances.
Ethical considerations should be maintained during the publication or streaming of any information. Media should have self-regulations to fact-check and publish only authorised and double-verified information.
Given the borderless nature of the internet and the rapid, global spread of misinformation, international cooperation is imperative. Addressing the challenges posed by cross-border mis/disinformation requires a shared understanding and coordinated response among states at the global level.
References
- https://pam.int/wp-content/uploads/2024/10/EN-Background-paper-on-disinformation-and-fake-news-Jan-2024.pdf
- https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3172349
- https://www.unesco.org/sites/default/files/medias/fichiers/2023/04/draft2_guidelines_for_regulating_digital_platforms_en.pdf
- https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/digital-services-act_en
