CBI arrests one in multinational cyber probe Operation CYSTRIKE

What the Record Shows

The Central Bureau of Investigation launched a multinational operation, code-named CYSTRIKE, and conducted searches at 35 locations across ten states on 30 January 2026, according to the agency's press release dated 2 February 2026. The CBI said the operation targeted transnational cyber-enabled financial crime networks and was carried out in coordination with the Federal Bureau of Investigation of the United States and law-enforcement counterparts in the United Kingdom, Kuwait, Ireland and Singapore, with support from INTERPOL.

Per the release, the searches spanned New Delhi, Bihar, Maharashtra, Karnataka, Punjab, Rajasthan, Uttar Pradesh, Uttarakhand, Telangana and West Bengal. The CBI said it arrested one key operative in New Delhi and seized about Rs 60 lakh in cash from one accused during the searches. Investigators also recovered laptops, mobile phones and computer hard disks said to contain incriminating material, the agency stated.

At this stage the matter is an investigation. The CBI has not made public the name of the person arrested, has not disclosed a case-registration number or the statutory provisions invoked, and has not filed a chargesheet. No court has examined the allegations and no finding of guilt has been recorded. Everything set out below is drawn from the agency's own account of what it is examining.

The release does not record any response from the person arrested. As an investigation-stage action, the agency's statement reflects what it alleges it has found so far, not a judicial determination.

How It Worked

According to the CBI, the networks operated under false identities and used India-based infrastructure to run cyber-enabled financial crimes against victims in India and the partner jurisdictions. The agency said the operation was designed to map and dismantle the mule-account layer that such networks rely on to move money - the ordinary bank accounts, often opened in others' names, through which proceeds are routed to disguise their origin.

The CBI said one strand of the activity it is investigating involved a website that falsely offered Kuwaiti electronic visas and overseas employment to Indian nationals in exchange for payment. In its release the agency identified the domain as eservicemoi-Kw.com and said fake Kuwaiti e-visa documents were among the material recovered during the searches. The agency's account is that the site mimicked an official visa-issuance service to collect money from applicants seeking work abroad.

The CBI described a second strand aimed at victims in the United States, in which, per the agency, mule accounts were used to channel the proceeds of crime raised from foreign victims. It was in connection with this strand that the agency said it made the arrest in New Delhi and seized the Rs 60 lakh.

Procedurally, the operation is at its earliest stage. The CBI's release records searches, one arrest and the seizure of cash and electronic devices. The next steps in any such matter would be forensic examination of the seized devices, tracing of the identified mule accounts, and a decision on whether to register formal charges. None of that has been reported as complete, and the agency has framed its statement as an account of an operation in progress rather than a concluded case.

Who Lost Money

The CBI's release points to two pools of people it says were targeted. The first is Indian nationals who paid for Kuwaiti e-visas and job offers that the agency says were fake. The second is overseas victims, including in the United States, whose money the agency says was routed through Indian mule accounts. The release does not put a total figure on the losses to either group, and no verified victim tally has been published.

The only sum quantified in the CBI's account is the roughly Rs 60 lakh seized from one accused. That is a seizure, not a measure of what victims lost or of what they may eventually recover. In cyber-enabled cases the money is frequently layered through several accounts and, in cross-border matters, moved out of the country quickly, so the amount recovered at the search stage is typically far smaller than the amount alleged to have been taken.

For the Indians who paid the fake-visa site, the loss is both the money and the aspiration it was attached to - the same overseas-job hope that recruiters exploit elsewhere. That aspiration-preying pattern recurs across the enforcement record, from deposit collectors to job rackets, as our report on the Khanna organic-farming deposit probe illustrates. Whether any of these individuals recover their payments will depend on how the investigation develops and whether the funds can be traced.

Where It Stands Now

As of today the matter remains an open CBI investigation. One person is reported to have been arrested in New Delhi; the CBI has not publicly named that person, disclosed the sections of law under which they are held, or announced whether a chargesheet has been filed. Re-checking the position against the available official account shows no change from the position at the end of January 2026: this is still an investigation-stage action, not a prosecution and not a conviction.

Because the action carries the markers of a criminal investigation - an arrest, a seizure and a multi-agency probe - the presumption of innocence applies in full. The CBI's press release contains allegations and describes an investigation in progress; it is not a finding of guilt. The person arrested is presumed innocent unless and until a competent court convicts, and due process continues.

The international dimension means parallel steps may be under way in the partner jurisdictions. Any prosecution in India would proceed only after the CBI completes its investigation and, if it decides to charge, files before the appropriate court.

What It Means

The value of a case like this for an ordinary reader is not the headline arrest but the mechanics it exposes. Two of the most common cyber-crime patterns in India meet here: the fake overseas-job or visa site that takes money up front, and the mule-account network that moves proceeds raised abroad. Both monetise trust - one in a government-looking website, the other in a friend or stranger who offers to "use your account for a small fee".

The practical takeaways are concrete. A genuine Kuwaiti e-visa is issued only through official government channels; a private-looking domain asking for payment and personal documents to "guarantee" a visa or job is the pattern the CBI describes here, and it can be checked against the official embassy or e-visa portal before any money changes hands. And letting someone route money through your bank account, however small the promised cut, is how mule networks operate - the account holder is the person investigators reach first.

For anyone weighing a "guaranteed" overseas opportunity, verifying the counterparty before paying is the single protective habit that matters; our enforcement archive tracks how these schemes are dealt with once the authorities act, as in the recent SecureKloud recovery matter. This is a reporting of an agency action, not advice to take or avoid any product.

FAQ

Does the CBI investigation mean the people named are guilty?

No. Operation CYSTRIKE is an investigation. The CBI's press release contains allegations and describes searches, one arrest and a seizure; it is not a finding of guilt. The person arrested is presumed innocent unless and until a competent court convicts them, and due process continues.

What exactly did the CBI announce?

Per its release dated 2 February 2026, the CBI conducted searches at 35 locations across ten states on 30 January 2026, arrested one key operative in New Delhi, seized about Rs 60 lakh from one accused, and recovered laptops, mobile phones, hard disks and fake Kuwaiti e-visa documents, in coordination with the FBI and counterparts in the UK, Kuwait, Ireland and Singapore.

Was anyone convicted or charged?

No conviction has been recorded. The CBI has not publicly disclosed a case number, the statutory sections invoked, or whether a chargesheet has been filed. The matter is at the investigation stage.

What is a mule account?

A mule account is an ordinary bank account, often opened in another person's name or lent out for a fee, through which criminals route the proceeds of fraud to disguise their origin. The CBI says such accounts were used in this case to channel money raised from foreign victims.

How can I check whether a visa or job offer is genuine?

Kuwaiti e-visas and most government services are issued only through official state portals. Verify the web address against the relevant embassy or government site, never pay a private domain that "guarantees" a visa or job, and treat any request for advance payment and personal documents with caution.

Where can I read the official record?

The CBI's press release on Operation CYSTRIKE is published on the agency's website; it is linked at the end of this report.

This report is based on the Central Bureau of Investigation press release on Operation CYSTRIKE dated 2 February 2026 and corroborating public reporting reviewed on 3 August 2026.