'Your phone could be hacked without a single click': Inside the mind of a hacker

In an increasingly-connected world, where personal information is traded on the dark web and artificial intelligence is reshaping cybercrime, even a momentary lapse in judgment can expose someone to financial fraud. How safe are we online? As cybercriminals develop more sophisticated methods to exploit digital vulnerabilities, cybersecurity is no longer just about protecting devices and networks but also about understanding human behaviour.

Wayanad-born ethical hacker and cybersecurity researcher Benild Joseph has spent nearly two decades exploring how hackers operate and identifying security vulnerabilities in major digital platforms, including Facebook, Yahoo and Sony. The founder of Bengaluru-based cybersecurity firm Secure Mojo, Joseph has also been featured in Hacking the Hacker, a book by cybersecurity expert Roger A Grimes.

In an exclusive interview with Mathrubhumi English, Joseph discusses the world of hackers.

What sparked your interest in hacking, and what challenges did you face?

My journey began in Class 9, in the early 2000s. I would call myself a first-generation Indian hacker, from a time when cybersecurity was in its infancy in India. The country introduced its first cyber law in 2000, but a more comprehensive framework came only with the 2008 amendments, and awareness was very low. Law enforcement did not have the technical expertise it has today, so identifying perpetrators was extremely difficult.

Hacking was also not recognised as a profession. The word "hacker" was almost synonymous with internet thief or cybercriminal. There was hardly any awareness that hacking could be used positively, or that ethical hacking could become a career.

Growing up in Wayanad, a predominantly rural district, made it harder. Computers and the internet were extremely limited; we could use them only at internet cafés or in the school computer lab. It was during this period that I came across the name of Indian hacker Ankit Fadia in a book. That sparked my curiosity. I started wondering how someone could actually hack into a computer system.

You once said your hacking journey began with you getting hacked. What happened?

I wanted to find out how to hack someone's email account. I found an article claiming a particular software could hack any account. It asked for three things: my own username, my own password, and the email address of the person I wanted to hack. Then I clicked a button labelled "crack".

A progress bar moved from 10 to 50 to 70 to 99 per cent, but never reached 100. I tried for two or three days, then gave up. A few days later, when I tried logging into my own email, I discovered someone had changed my password two days earlier. That was my first real encounter with cybercrime. The irony was that while I was trying to hack someone else's account, mine got hacked first.

How easy is it to hack major platforms like Google or Facebook, and what role does human behaviour play?

Hacking has two sides, like two sides of a coin. The first is technical: finding vulnerabilities in the technology and exploiting them. To take over someone's Facebook account this way, I would have to compromise Facebook's servers. To hack a bank, I would have to compromise the bank's systems. By my assessment, 99 per cent of such attempts are practically impossible, while perhaps one per cent may succeed. I say one per cent because no technology in the world is 100 per cent foolproof.

The second side is the person using the technology. Instead of attacking the system, a hacker manipulates the human operating it. If the target is a bank, I focus on a bank employee. If it is a government institution, a staff member. If it is a media organisation, an employee there. I look for vulnerabilities in their behaviour. In technical terms, this is called social engineering.

Why is social engineering often more effective than exploiting technical vulnerabilities?

From an offensive security perspective, manipulating a person offers roughly a 99 per cent chance of success, compared with the one per cent I associate with exploiting technical flaws. Even in India, when we hear that someone has lost access to an account, the underlying issue is often human manipulation, not a technical failure. It could be a weak password or a mistake made while interacting with a digital platform. These are weaknesses of user behaviour.

Can antivirus software, VPNs and other tools truly protect our devices?

A conventional cybersecurity professional will recommend antivirus, a VPN and end-to-end encrypted storage. These are the measures taught in awareness programmes. But my argument is that none of them, by themselves, can guarantee security.

When a company builds antivirus software, it defines the scope: certain categories of malicious programs. But technology keeps evolving, and so do attackers. A hacker's approach comes from creativity and an understanding of how systems work, and sometimes an entirely new attack emerges. We call previously unknown vulnerabilities and their exploitation zero-day attacks. The wider world often learns about them only after the damage is done.

Even with major data breaches, we often know that data was exposed but not how the attackers did it. How can you anticipate an attack when the method exists only in the attacker's mind? That is why I treat antivirus, VPNs and similar tools as precautionary measures. They protect against certain threats but cannot eliminate every risk.

Why do you believe human error is behind most cybercrime in India?

In my assessment, around 95 per cent of cybercrime incidents in India involve some form of human error or behavioural vulnerability. Take 100 victims: some were cyberstalked, some harassed, some lost money to fraud, some had accounts hacked. I believe about 95 of those cases would involve human error rather than a purely technical failure.

It is not necessarily because the victims lacked antivirus or weren't using an iPhone. The issue is how people interact with technology. Strong passwords, multifactor authentication and encryption are all legitimate measures, but alone they cannot guarantee an account stays secure. The most important thing is to make the person using the technology smarter about how they respond to threats.

How do hackers trick people, and why does timing matter?

From a hacker's perspective, creating urgency and fear is far more effective than exploiting a lack of technical knowledge. The question I ask is: how can I make the person act before they have time to think?

I work with influencers, founders and celebrities. In one recent case, an influencer received what looked like a Facebook security prompt at around 2 am, asking "Is this you?" The person was sleepy and not paying attention, responded without verifying, and that single click compromised the account. Had it arrived in the morning, the person might have been alert enough to spot something suspicious.

To the attacker, 2 am was not a random time. It was a chance to exploit the victim's physical and mental state. That is manipulating human behaviour rather than attacking Facebook's infrastructure.

How does a hacker gather information about a person before attacking?

Hacking is an art, like singing or dancing, but professional hacking follows a structured process with five steps. The first is reconnaissance: studying the target and gathering information, online or offline.

In my company, which focuses on personal cyber protection, one of the first things we do is assess a person's digital exposure, meaning how much information about them is already on the internet. This is called Open Source Intelligence, or OSINT, and it can reveal a surprising amount.

How much of our personal information is actually available online?

Suppose you have used the internet for ten years, creating accounts on Zomato, Flipkart, Myntra, Uber, Ola and others with the same email and phone number. Each knows something different about you. Ola may know where you live, your regular routes, your date of birth. Myntra knows your sizes and style preferences. Zomato knows your eating habits.

If one of them suffers a breach, some of that information is exposed, and breaches happen to large and small companies alike. Put the pieces together, and you can reconstruct a person's history: where they studied, what they like, what they do online. Privacy, the way most people imagine it, is almost a myth. A significant part of our lives may already be exposed.

Has the growing number of data leaks become a national crisis? What makes Indians vulnerable?

There are several reasons. First, our huge population means a larger pool of people at risk. Second, how data is stored, managed and protected differs by country. Some countries have strong privacy laws and strict regulations; in India, we may not have the same protection or enforcement in every situation.

Imagine a major bank like SBI suffers a breach. Customers trusted the bank with their data, and they may suffer financial losses. Who takes responsibility? Does the bank compensate them? What mechanisms protect them? These are important questions.

Another aspect is that banks and government agencies keep warning us not to share OTPs, but awareness alone is not enough. When we read about a scam victim, we think, "How could someone be so foolish?" But when we face a similar situation, our reaction can be completely different, because criminals exploit emotions and circumstances, not just ignorance.

We need to focus on behaviour. Cybersecurity should be taught in schools, with a simple principle: Stop, Verify, Proceed. On receiving a suspicious message, link or request, first stop, then verify it is genuine, and only then proceed.

Also, when a scam victim approaches the police, there is no point asking, "You are so highly educated, how could you make such a foolish mistake?" Education does not protect you from cybercrime. Sometimes highly educated people are particularly vulnerable to certain scams.

How vulnerable are India's public institutions and PSUs to cyberattacks?

It is difficult to measure a country's vulnerability in absolute terms. India has a huge population, many institutions and enormous amounts of data, so there are more potential targets, and a high number of reported attacks does not mean India is more vulnerable than other countries. But do we have a sufficiently robust system to prevent attacks? I would say there are still significant gaps.

Vulnerabilities are not geographical. If a bank in India had a particular weakness, the same system with the same configuration in the United States could be exploited there too. A system is vulnerable because of how it is designed, configured and maintained. And in upgrading and maintaining digital infrastructure, I believe India still lags in certain areas, particularly in public institutions, whether due to administrative limitations or lack of interest among those responsible.

A friend of mine, Gujarat-based researcher Kanishk Sajnani, found vulnerabilities in the websites of Cleartrip and Air India around 2016 or 2017. In one instance, he was reportedly able to book a Bengaluru–California flight for one rupee. He documented the flaws, prepared a proof of concept and emailed both companies, which is called responsible vulnerability disclosure. Cleartrip acknowledged the report and rewarded him through something like a bug bounty. According to him, Air India, then still government-owned, did not respond. Only after he tagged the airline and the minister on Twitter did the issue get attention.

Just because a system has not been hacked does not mean it is secure. It may simply be that no hacker has shown interest. That is a dangerous situation.

How do hackers gain access to high-profile social media accounts?

The technical security a platform offers is generally the same for everyone. My Twitter account and a president's have the same basic features. What matters is who operates the account. Celebrities, politicians and sportspersons usually have social media managers.

A senior Malayali cricketer's Instagram was managed by a young man in Ernakulam. One day he received what looked like a brand collaboration invitation from Adidas, from a profile with a blue tick, asking him to fill out a form. The player was away at an IPL-related camp, so the manager filled it out. Within half an hour, they lost the account.

The attacker had taken over another Instagram page and changed it to look like the brand's official account, with the logo and a verified badge. At the time, profile changes like a new picture did not trigger the verification checks you might expect today. The hacker did not break the celebrity's account security. He created a convincing situation in which the person managing it voluntarily interacted with something malicious.

What did your experience with Facebook reveal about its vulnerabilities?

I reported two issues. The first dates from when Facebook introduced custom usernames and allowed third-party applications. I built a small PHP app, a password-strength checker. I registered a username that made the page look associated with Facebook's account security, and connected the app to it. People assumed it was an official service. About 1.5 lakh people used it, and the passwords they entered were accessible to me. The flaw was that someone could impersonate an official Facebook service and harvest credentials from unsuspecting users.

The second, around 2012, involved the account recovery feature based on trusted friends. A user who lost access could regain it through friends who received recovery codes. I identified a way this trust-based mechanism could be manipulated: an attacker could first build apparently genuine connections with the target through accounts they controlled, over a week, ten days or two weeks, and then exploit those connections in the recovery process. A feature meant to help legitimate users could be abused by someone who had deliberately engineered those relationships.

Can someone hack our smartphone without us clicking a link, downloading an app or interacting at all?

Yes. That is where sophisticated spyware like Pegasus comes in, a surveillance tool developed by an Israeli company. There have been reports and allegations that prominent individuals in India, including political figures such as Rahul Gandhi, were targeted.

Normally, compromising a phone requires installing spyware or a malicious app, either through physical access to an unlocked device or by tricking the person via social engineering, for example, impersonating a bank or an employer. Either way, the victim interacts in some way.

Pegasus has been associated with zero-click attacks, which require no clicking, opening or installing. In certain documented cases, a specially crafted call exploited a vulnerability in a messaging app even if the recipient never answered. A missed call could be enough, and the user might never notice. The mitigating factor is cost: it is extremely expensive, reportedly running into crores of rupees (I understand around ₹8 crore, depending on the arrangement), so it is not a tool an ordinary criminal can easily buy.

Can hackers secretly access a phone's camera, microphone and messages?

Yes. Once sophisticated spyware with remote-access capability is installed, an attacker may be able to monitor and control much of the device. If I were sitting in Bengaluru and had compromised a phone in Kerala, I might see it almost as a copy of that phone on my screen: reading WhatsApp and SMS messages, opening apps, monitoring communications, and potentially activating the camera or microphone.

This also affects two-factor authentication. If the attacker can read incoming SMS, the OTP becomes accessible too. 2FA is important, but it cannot protect you when the device receiving the code is already under an attacker's control. We should not assume a phone is secure just because it has antivirus or 2FA.

What is gang stalking, and how can technology be used to harass someone?

This is an issue that deserves more attention. About eight years ago, I received an email from a man then working in Bengaluru. The message was unusual. He claimed that someone had been continuously monitoring and stalking him. He said he had completely lost his privacy and that unknown people somehow knew everything he was doing. He described a situation in which he felt he could no longer live normally. When I first read the email, I found his claims extremely difficult to believe. Some of the things he described seemed almost impossible.

For example, he believed that he was being monitored through electrical sockets, adapters and other ordinary objects around him. I could understand someone being concerned that their phone or computer had been hacked. But the extent of the surveillance he was describing was difficult for me to comprehend. So, at that time, I did not pursue the matter. Then, around a year and a half ago, someone contacted me through Facebook. This person said he was approaching me on behalf of a friend. As he began explaining the situation, I realised that the details sounded very similar to the email I had received years earlier.

It turned out to be the same person. He was originally from Thiruvananthapuram and had previously worked for an IT company there. He was working at Infosys in Bengaluru when he first contacted me. By the time I heard about him again, I was told that he was working in the United States in a contractor role associated with Meta. Since another person had now approached me about the same allegations, I decided to speak directly with the individual. He told me that he had been experiencing what he believed was continuous surveillance and harassment for several years.

According to him, the situation had become so distressing that he could no longer stay in one place. He said he had started moving between Airbnb properties, sometimes changing accommodation almost every day. He also claimed that he occasionally worked from his car after parking it on the roadside. I asked him to describe a specific incident that made him believe he was being monitored. He gave me an example. He said that one evening, he booked a flight ticket to India. After making the reservation, he went to sleep. The following morning, when he approached his car, he allegedly found a printed copy of his flight ticket placed under the windshield wiper. He also described another incident involving a woman he had met through a dating application. According to him, he had been chatting with a Chinese woman online. The next day, he claimed to have seen the same woman sitting at a nearby bus stop. He also spoke about incidents involving his family in Thiruvananthapuram. His father was a retired officer from the State Bank of India, and the family had a dog. He claimed that conversations involving the dog were somehow being monitored. Three days later, the dog was found killed.

I could not independently establish whether these incidents happened as he believed or were connected. But it led me to look into allegations of technology-assisted harassment, and I found similar complaints in other countries, including cases where people struggled to produce evidence. Sustained over weeks, this could have a serious psychological impact.

One possibility I have considered is that such harassment could be arranged remotely using online groups where people are paid for small tasks, such as on Telegram. An organiser could study a target's routine, and if private communications had been unlawfully accessed, direct a paid stranger to appear somewhere, say at a traffic signal, holding the name of a resort where the target had privately planned a birthday party. The person doing the task may not know why. But the target, believing the plan private, would find it deeply disturbing.

What should someone do if they get hacked?

There are two tracks: legal and technical, and the right response depends on the attack. Take ransomware, where files are encrypted, and attackers demand cryptocurrency. You can file a police complaint, but investigating such cases is hard. Often the only lead is a crypto wallet address, and tracing the people behind it is difficult. Filing a complaint is important, but do not assume the police will recover your files or money.

On the technical side, the first step is to identify the type of infection. If it is a known variant, a professional may be able to remove it and find a decryption method. If it uses strong encryption with no known fix, recovery is extremely difficult. You can reinstall the operating system, but that does not restore encrypted files.

That is why backups matter. A clean backup lets you restore data once the system is secured. People think about cybersecurity only after something goes wrong, by which time it may be too late. Regular backups are among the most important precautions anyone can take.

Why is cyber insurance important in 2026?

Most people are unaware that cyber insurance exists in India. We know motor, vehicle and health insurance, but policies also cover certain cybercrime risks, and they have been available for years with very little public attention.

Some are inexpensive. I have seen family coverage where a premium of around ₹2,000 provides several lakh rupees of protection for a husband, wife and children. If someone clicks a malicious link and loses ₹2 lakh, they can report to the cybercrime police, and if the money is recovered, that is the best outcome. If not, a suitable policy may cover certain financial losses, and some also cover legal expenses, technical assistance and psychological counselling.

I also believe insurers have not promoted these products actively. One possible reason, in my opinion, is that cyber fraud is so widespread that they worry about the volume of claims.

Are India's privacy laws and cybercrime enforcement strong enough?

Strong cybersecurity needs strong laws and effective enforcement. Technology cannot protect people if the legal framework is weak or authorities lack resources to investigate.

Compare India with countries like Switzerland, Ireland or Canada: there are differences in how personal information is protected and how authorities request it. If someone in India sends a fraudulent email to a company in the UAE, investigators would trace an Indian IP address and seek the person's details through the applicable procedures. Safeguards governing such access are crucial. If the person were in Switzerland, Ireland or Canada, investigators would have to respect those countries' privacy laws.

India needs stronger and more consistent safeguards. We must allow legitimate criminal investigations while protecting ordinary citizens from unnecessary disclosure or misuse of their data. Both matter, and there is considerable room for improvement.

Why has Telegram become associated with cybercrime?

I strongly believe in the right to privacy: everyone should be able to communicate privately without constant monitoring. Telegram attracted many users partly because of its reputation for privacy.

There are two questions: do hackers use Telegram themselves, and do cybercriminals use it to reach ordinary people? I do not believe sophisticated hackers necessarily rely on it for their most sensitive communication; they use other tools depending on their needs. But wherever large numbers of people gather, criminals see opportunities for fraudulent offers, impersonation and scams.

That does not mean the platform exists for crime. The central tension is that the same privacy protections that shield legitimate users from surveillance are also attractive to people wanting to hide illegal activity.

How are hackers using artificial intelligence?

Mainly to automate stages of an attack. Planning begins with reconnaissance. If I wanted to target a media organisation, I would need to know who works there, what their roles are and how departments connect. AI can help collect publicly available information, organise employee details, build profiles and spot patterns- work that once took considerable time and effort.

That does not mean AI automatically lets someone hack a system. But it makes information gathering, profiling and planning more efficient.

How secure are UPI and digital payment platforms?

We need to distinguish between compromising the payment infrastructure and deceiving the people who use it. We rarely hear of attackers directly compromising the infrastructure of major payment systems. What we hear about is phishing and impersonation: fake payment pages that look like real banking services, fraudulent QR codes, and imitation websites.

Major providers, such as BillDesk and Razorpay, which run payment infrastructure for businesses, must follow established security standards and generally have significant protections. That does not mean vulnerabilities can never exist, but most fraud affecting ordinary users comes from criminals exploiting how people use these services. It is easier to create a convincing imitation than to break into a protected system. The real question for users is whether they can tell a genuine payment request or website from a fake one.