The Inter-Services Intelligence (ISI), intelligence agency of Pakistan has been involved in running military intelligence programs in India, with one of the subsections of its Joint Intelligence Bureau (JIB) department devoted to perform various operations in India. The Joint Signal Intelligence Bureau (JSIB) department has also been involved in providing communications support to Pakistani agents operating in Indian-administered Kashmir. The Joint Intelligence North section of the Joint Counter-Intelligence Bureau (JCIB) wing deals particularly with India. In the 1950s the ISI's Covert Action Division was alleged for supplied arms to insurgents in Northeast India.
India has also accused the ISI of reinvigorating separatism and insurgencies in the country via support to pro-Khalistan militant groups such as the International Sikh Youth Federation (ISYF), in order to destabilize India. A report by India's Intelligence Bureau (IB) indicated that ISI was "desperately trying to revive Sikh" militant activity in India. The ISI is also allegedly active in printing and supplying counterfeit Indian rupee notes.
History The ISI was created after the Indo-Pakistani War of 1947, due to the Military Intelligence of Pakistan's (MI) weak performance. When Zia-ul-Haq seized power in July 1977, he started his K2 (Kashmir and Khalistan) strategy, initiating Operation Tupac.Ghosh 2000 pg.3 He gave ISI the duty to make Jammu and Kashmir a part of Pakistan, and to send insurgents to Punjab. The intelligence agency's aims are to confound Indian Muslims using Kashmiri Muslims, extend the ISI network in India, cultivate insurgents and insurgent groups, cause attacks similar to the 1993 Bombay bombings in other cities, and create a state of insurgency in Muslim-dominated regions.Ghosh 2000 pg.8 The ISI has allegedly set up bases in Nepal and Bangladesh, which are used for operations in North-East India.
Espionage Activities
Notable incidents
2020s In 2023, Labhshankar Duryodhan Maheshwari, a 53-year-old man of Pakistani origin who had been residing in India as a citizen for 17 years, was arrested on charges of espionage. He was accused of assisting Pakistani agents in obtaining an Indian SIM card, which was allegedly used to hack the mobile phones of children of Indian defense personnel studying in army schools, according to local media reports.
On 4 February 2024, Satendra Siwal, an employee at the Indian embassy in Moscow, was arrested in Meerut, Uttar Pradesh, on charges of espionage for allegedly providing classified information to Pakistan's Inter-Services Intelligence (ISI). According to the Uttar Pradesh Anti-Terrorist Squad, Siwal had been sharing confidential military information in exchange for financial incentives and was booked under the Official Secrets Act.
In June 2025, the Amritsar Rural Police apprehended two individuals named Gurpreet Singh alias Gopy Foji and Sahil Masih alias Shali on suspicion of involvement in espionage activities linked to ISI. According to Punjab Police, preliminary investigations revealed that Gurpreet Singh had been in direct contact with ISI operatives and was suspected of transmitting sensitive and confidential information using pen drives. The key ISI handler in the case was identified as Rana Javed. Authorities seized two mobile phones reportedly used to communicate with ISI contacts. The arrests were part of a broader effort to dismantle an espionage and terror network with cross-border links.
In December 2025, Itanagar police arrested two men from Jammu and Kashmir’s Kupwara district, Nazir Ahmad Malik and Sabir Ahmed Mir, after discovering that they had repeatedly traveled through Arunachal Pradesh posing as clothes sellers while allegedly collecting and transmitting information on Army movements and military installations to Pakistani handlers via a Telegram channel named "Al-Aqsa."
In January 2026, authorities arrested a contractor from Ambala in Haryana for allegedly attempting to pass on defence-related information to Pakistani handlers. He was allegedly honey-trapped and kept contact with the Pakistan-based module for nearly seven months.
In March 2026, a tip-off at Ghaziabad's Kaushambi police station uncovered a Pakistan-linked espionage network recruiting vulnerable youths to film military sites and railway stations. Led by handlers Suhail Malik, Naushad Ali, and Sameer alias Shooter, the group used social media to coordinate reconnaissance for potential terror attacks and install surveillance cameras along the Delhi-Jammu railway corridor. Over 22 arrests were made, and the operation's scope extended to 50 planned surveillance targets, with connections to foreign training and over 450 files traced to Pakistan.
In May 2026, there were two consecutive blasts in Amritsar and Jalandhar. The Punjab Director General of Police stated that it was Pakistan's "ISI design."
On May 30 2026, an Indian Air Force Wing Commander was arrested on accusations of spying for Pakistan and attempting to install malware on his colleague's phone. The officer was "honey-trapped by a Pakistani intelligence operative," the Delhi police said.
On October 3 2026, a Indian Navy sailor was arrested at INS Agrani in Coimbatore for leaking sensitive defence data to a female Pakistani intelligence operative. The sailor reportedly fell victim to an online honeytrap on social media a few months ago. He was accused of compromising highly classified operational files regarding strategic naval assets, base setups, and fleet movements.
Use of Influencers On 13 May 2025, India declared Mohammad Ehsan Ur Rahim, a staff member at the Pakistan High Commission in New Delhi, persona non grata for allegedly engaging in activities inconsistent with his diplomatic status, specifically espionage-related conduct. Additional details regarding the expulsion emerged after 17 May, following the arrest of an Indian YouTuber, identified as Jyoti Malhotra, who was allegedly involved in the case. Rahim had reportedly established contact with Malhotra in 2023 and maintained communication during the brief 2025 India-Pakistan conflict. Over time, Rahim is alleged to have cultivated Malhotra as an asset by introducing her to individuals linked to Pakistani intelligence and facilitating her visit to Pakistan, where she reportedly met intelligence officials. Later in June, it was revealed that a former Pakistani sub-inspector turned YouTuber Nasir, and a female accomplice by the name of Naushaba, were specifically tasked by the ISI to cultivate Indian influencers. Nasir would target Indian YouTubers visiting Pakistan and connect them with a high commission official who would them inivite them to the Pakistan high commission and subsequently give them espionage tasks. A YouTuber by the name of Jasbir Singh, who was also connected to the spying ring, too pointed at Nasir as a key figure behind the operation.
Use of Minors Officials suggest that ISI has a deliberate strategy to target young and impressionable individuals, especially minors who'd be a soft target for digital grooming before turning them into a state asset. The narco-terror groups targeted vulnerable individuals along the border via social media chat rooms. For example, in January 2026, Punjab Police arrested a minor from Pathankot for allegedly leaking defence-related and national security information to Pakistan. The juvenile was contacted through social media by handlers linked to Pakistan’s ISI and associated groups and was emotionally manipulated into sharing details about sensitive security installations. Around this time, about 37 minors were under scanner over this kind of exploitation. According to officials, "unconventional apps" are used for brainwashing and target devices are cloned via malicious links for extracting information.
In March 2026, an operation uncovered a racket supplying Indian OTPs and SIM cards to foreign actors for running social media accounts. Payments ranged from Rs 500 to Rs 5,000, with SIMs acquired through snatching, phishing, and forged IDs. On March 20, nine people, including five minors, were arrested across multiple states and Nepal. On March 22, Naushad Ali alias Lalu and Meera, an e-rickshaw driver with ties to Pakistani handler Sarfaraz alias Sardar, were detained. The operation primarily targeted vulnerable minors for recruitment and logistics.
Cyber warfare and espionage One of the key methods involve employment of fake Facebook accounts for "honey-trapping" and VoIP calls that help concealing the country code. Countries like Thailand, Sri Lanka, and Indonesia have been used as intermediaries for such calls. The Anti-Terror Squad of Uttar Pradesh Police once caught 125 fake profiles of women incorporated for such an endeavor.
Meta, in its May 2023 adversarial threat report, indicated a Pakistan-linked hacking group, active since 2015 and associated with GravityRAT spyware, targeted military personnel in India through extensive social engineering, using fake personas such as women, recruiters, journalists and military staff to trick victims into clicking malicious links or installing seemingly benign apps; Meta noted that this approach enabled the group to use low-sophistication malware effectively.
Instagram too has been exploited for espionage and terror activities. The platform was being misused to recruit youth as foot soldiers and sleeper cells to carry out terrorist attacks in India. The Shahzad Bhatti terror module employed such techniques. In some notable cases, Shahzad Bhatti was directly in contact with potential individuals on the platform. Youth from Rajasthan's border areas were also being recruited. Similarly, in April 2026, a woman named Sayeeda Begum with 38,000 Instagram followers was caught spreading ISIS and AQIS propaganda and recruiting individuals as young as sixteen while encouraging them to visit Pakistan for arms training.
Hacking groups are also central to such operations. APT 36, also known as Transparent Tribe and "SideCopy," a Pakistan-linked APT group, is alleged to have conducted cyber espionage in India and Afghanistan. An advanced spyware called DeskRAT was utilized for attempts made on Indian government and military networks.
After the 2025 India-Pakistan conflict, it was reported by Maharashtra Cyber that 7 APT groups from Pakistan attempted 1.5 million cyberattacks on Indian critical infrastructure but only about 150 succeeded roughly translating to a failure rate above 99%. APT 36 among other groups such as "Pakistan Cyber Force", Team Insane PK, Mysterious Bangladesh, Indo Hacks Sec, Cyber Group HOAX 1337, and National Cyber Crew were held collectively responsible for these attempts.
In November 2025, Pakistan-based intelligence operatives reportedly attempted to lure CAPF officers by impersonating senior officials, technical staff, or acquaintances on WhatsApp, engaging them in conversation for several days before sharing a fraudulent group-joining link presented as an official or personal channel; once an officer joined, the link enabled the installation of Trojan-type malware that provided remote access to the device and its WhatsApp groups, allowing the infiltrators to covertly add unknown numbers to multiple communication channels and harvest sensitive information.
Operations in Jammu and Kashmir