Background and Timeline: The Delhi Police achieved a massive investigative milestone on Saturday, January 31, 2026, following a month-long special drive titled “Operation CyHawk.” The operation focused on dismantling high-velocity fraud modules that have been targeting residents across the National Capital Region. This coordinated strike involved simultaneous raids across multiple hotspots in Southwest Delhi, addressing a combined backlog of hundreds of independent cyber complaints.
Modus Operandi: The arrested individuals were part of organized inter-state modules that specialized in “Utility and Identity Fraud,” including fake KYC updates and banking impersonation. They utilized sophisticated call centers to induce panic among victims, claiming their accounts would be blocked unless they installed malicious APK files for verification. These APKs provided the gang with remote access to the victims’ mobile devices, allowing them to intercept OTPs and fraudulently avail high-value personal loans.
Victims and Financial Impact: The wider network dismantled under Operation CyHawk is linked to a staggering ₹254 crore in financial losses documented through the National Cybercrime Reporting Portal (NCRP). Police identified 377 specific complaints where the accused were directly linked to siphoning funds from individual savings and corporate accounts. The impact is nationwide, with victims spanning from Delhi to southern states, highlighting the broad administrative reach of these local modules.
Investigation and Agencies Involved: DCP (Southwest) Amit Goel led the operation, which utilized advanced data analytics and financial trail mapping to identify the account clusters. Investigators successfully registered 23 new FIRs during the drive, based on the interrogation of key “layer 1” mule operators. The Delhi Police team recovered a significant cache of evidence, including 43 mobile phones, 17 bank passbooks, 14 debit cards, and over ₹1.5 lakh in liquid cash from the raid locations.
Arrests and Suspects: A total of 42 suspects were taken into custody during the coordinated raids in Southwest Delhi, including masterminds, technical handlers, and mule account suppliers. These individuals are being interrogated to unmask their links with international handlers who are suspected of providing the malicious APK software. The police are currently auditing the 17 passbooks to trace the further layering of the ₹254 crore through secondary and tertiary bank accounts.
Broader Implications and Trends: Operation CyHawk demonstrates the effectiveness of “Aggregated Enforcement” where dozens of independent complaints are unified into a single technical strike against a common infrastructure. It highlights the continued dominance of “Remote Access Scams” in the Indian urban landscape and the critical need for mobile-level security awareness. Authorities have emphasized that the high volume of recovered bank instruments proves that local modules are the primary “exit points” for cybercrime.