The Spy Next Door: How Ordinary Indians Became Pakistani ISI Assets
Since the aftermath of the Pahalgam terror attack and India's retaliatory strikes under Operation Sindoor, Indian counterintelligence agencies have been on high alert. Over the past month, at least 15 individuals across Rajasthan, Maharashtra, Delhi, Haryana, Uttar Pradesh, Gujarat, and Punjab have been detained or arrested.
An engineer in Mumbai sketching warship blueprints after being honey-trapped on Facebook, a travel vlogger in Haryana escorted by armed men through Lahore's markets, a Rajasthan government employee with seven unexplained trips to Pakistan, and a SIM card supplier in Deeg funnelling information to Pakistan's Inter-Services Intelligence (ISI) handlers - each arrest, unconnected yet similar, reveals a wide network of people engaged in passing sensitive information to Pakistan.
Who are they?
The CRPF Insider: Moti Ram Jat
Moti Ram Jat was not a high-ranking officer, but his access to operational details within the Central Reserve Police Force made him a candidate that Pakistani operatives could exploit. According to the National Investigation Agency (NIA), Jat had been in contact with Pakistan Intelligence Officers (PIOs) since 2023, passing along classified information in exchange for money.
The NIA arrested Jat from Delhi earlier this month after his social media activity triggered internal alarms. The CRPF, in a rare public disclosure, acknowledged that Jat was dismissed after being found to have "acted in violation of established norms and protocols."
Jat is currently in NIA custody until June 6. Investigation is still underway to determine what information he passed on to India's nuclear-powered neighbour.
Honeytrap At The Dockyard: Engineer Ravindra Verma
In Maharashtra, the Anti-Terrorism Squad (ATS) arrested 27-year-old Ravindra Verma, a mechanical engineer employed by a Mumbai-based defence technology firm. Verma had access to the Naval Dockyard in south Mumbai and was involved in work related to submarines and warships.
His arrest was triggered by a forensic trail linking him to Facebook accounts under the names "Payal Sharma" and "Ispreet." Investigators say these profiles were fronts for Pakistani agents who gradually lured Verma into a honeytrap. Verma began sharing detailed sketches, diagrams, and audio notes about naval assets in exchange for money sent via Indian and international bank accounts.
According to the police, Verma was not merely duped but knowingly and repeatedly shared confidential data. While phones were prohibited inside the Naval Dockyard, he would reportedly sketch from memory and send images later. The ATS suspects he also supplied ship names and docking schedules. He had been communicating with the Pakistani operative since November 2024 and is currently in custody.
The Influencer Asset: Jyoti Malhotra
Perhaps the most publicly visible case is that of travel vlogger Jyoti Malhotra, who ran a popular YouTube channel. Her arrest by Haryana Police came in mid-May, following her alleged links to ISI operatives.
According to authorities investigating the case, Malhotra had direct, repeated contact with operatives at the Pakistan High Commission in Delhi, as well as during visits to Pakistan, at least two of which were confirmed by travel records. She reportedly interacted with Pakistani intelligence officials named Danish, Ahsan, and Shahid. Forensic examination of her seized mobile phones and laptops revealed a trove of over 12 terabytes of data, including communications that investigators claim confirm her awareness of the agents' ISI affiliations.
Despite being under scrutiny for disproportionate spending and multiple foreign trips, including to Pakistan and China, Malhotra continued her interactions with suspected handlers. One notable incident captured in a video by Scottish YouTuber Callum Mill showed her walking through Lahore's Anarkali Bazaar accompanied by six men armed with AK-47s.
Malhotra has been charged under the Official Secrets Act and sections of the Bharatiya Nyaya Sanhita. Her trial is scheduled to begin in June.
The Health Worker: Sahdev Singh Gohil
A 28-year-old health worker from Gujarat was arrested for transmitting sensitive information related to Indian military infrastructure to a Pakistani operative.
Officials from the Gujarat Anti-Terrorism Squad (ATS) confirmed last Saturday that Sahdev Singh Gohil, a resident of the border district of Kachchh, had been detained earlier this month on charges of sharing classified images and videos of newly constructed Indian Air Force (IAF) and Border Security Force (BSF) installations with a foreign agent.
Senior ATS officer K Siddharth said that Gohil came into contact with a person identifying herself as Aditi Bharadwaj via WhatsApp in 2023. Investigators now believe Bharadwaj was a cover identity used by a Pakistani intelligence operative. The communication, according to ATS sources, evolved into an exchange of visuals and data concerning Indian military sites near the border.
According to investigators, Gohil procured a new SIM card registered under his Aadhaar details in early 2025 and activated a WhatsApp account on behalf of the alleged handler using a one-time-password (OTP) authentication process. This channel, officials say, was subsequently used to transmit sensitive content documenting military construction and movements in the area.
The ATS also said that Gohil had received a cash payment of Rs 40,000 from an unidentified individual.
The Haryana Arrests
In Haryana, there has been a cluster of arrests which point to a recruitment effort by ISI targeting economically vulnerable young men.
Davender Singh Dhillon, a 25-year-old political science student from Patiala, was arrested after uploading pictures of firearms online. Investigation revealed that he had visited Pakistan in November 2024 and shared sensitive images of military installations.
Nauman Ilahi, a 24-year-old security guard, was arrested in Panipat. He had reportedly been transferring information to ISI handlers using his brother-in-law's bank account. Authorities confirmed cross-border money transfers.
Arman, 23, and Tarif, both from Haryana's Nuh district, were arrested within days of each other. Tarif was caught trying to delete chats with Pakistani numbers when police arrived at his residence.
The Bureaucratic Link
Shakur Khan, a Rajasthan government employee from Jaisalmer, was arrested on spying charges. Khan, 49, previously served as a personal assistant to former Rajasthan minister Shale Mohammad during the tenure of the Congress-led Ashok Gehlot government. Both men are from villages only 8 km apart. Mohammad, a two-time legislator and cabinet minister, has contested four state elections and is known to have affiliations with the 'Pir Pagara', a title held by the leader of the Muslim Sufi order of Hurs in Pakistan's Sindh
Khan had visited Pakistan at least seven times. His digital footprint showed deleted files and suspicious transactions. His connections are now being probed further by central agencies.
The Digital Front: SIM Cards and Apps
In a separate case, Delhi Police arrested Kasim, a 34-year-old from Rajasthan's Deeg, for allegedly supplying Indian mobile SIM cards to PIOs. He had travelled to Pakistan twice between August 2024 and March 2025, staying for extended periods. According to the police, Kasim facilitated the illegal export of Indian SIMs, which were then used by ISI operatives to contact Indians and solicit military information.
Kasim admitted to deleting all sensitive data post the Pahalgam attack, fearing exposure after nationwide arrests began. However, police are conducting a forensic analysis of his devices and reviewing call data records to map his network.
Another arrest in Thane involved an unnamed individual in Mumbai. He too was lured through Facebook and WhatsApp, sharing sensitive information between November 2024 and March 2025.
The Businessman and the Techie
In Uttar Pradesh, Shahzad, a businessman from Rampur, was detained by the Special Task Force in Moradabad. Shahzad reportedly shared intelligence with handlers during multiple visits to Pakistan and was involved in the smuggling of consumer goods.
In Jalandhar, Mohammad Murtaza Ali was arrested after allegedly using a mobile application he developed to send sensitive data to ISI operatives. Investigators seized four mobile phones and three SIM cards from his residence.
In addition to these confirmed cases, police and intelligence agencies are investigating two more individuals from Punjab, named Gazala and Yamin Mohammad, for similar offences. Authorities say both were in touch with foreign agents and are suspected of passing on sensitive information.
Post-Sindoor Vigilance
India's counter-intelligence has been reshaped following Operation Sindoor. Conducted in retaliation for the Pahalgam attack that killed 26 people, the operation saw India targeting terror camps in Pakistan and Pakistan-Occupied Kashmir. The subsequent retaliatory strikes by Pakistan, including drones and missiles, were largely neutralised by Indian defences.
Since then, surveillance across border states and strategic sectors has intensified. According to police in Rajasthan, seven suspects have been questioned in Jaisalmer alone in the last month. In Haryana, authorities have begun reviewing financial records and travel histories of individuals in vulnerable professions.
Trending News