The New Foot Soldiers of Espionage: How ISI is Weaponizing Indian Social Media

• From Instagram Direct Messages (DMs) to digital wallets, how Pakistani intelligence is recruiting vulnerable youth for pocket-money espionage.

By Jai Kumar Verma

Introduction – The Paradigm Shift

New Delhi. From Instagram DMs to digital wallets, how Pakistani intelligence is recruiting vulnerable youth for pocket-money espionage.

In a quiet town in Uttar Pradesh, an unemployed youth scrolls through Instagram, seeking validation and quick cash. He receives a friendly message praising his profile, followed by a seemingly harmless offer to take photos of a local railway station for a small fee. He accepts, unaware that this casual online connection is an Inter-Services Intelligence (ISI) handler operating from Karachi. A quick UPI transfer drops a thousand rupees into his digital wallet, sealing his entry into a dark web of low-cost treason.

This chilling reality marks a structural shift in Pakistan’s ISI operations against India. Moving away from highly trained cross-border infiltrators and heavily armed foreign militants, the agency has embraced the modern “gig economy” of espionage. By weaponising popular social media platforms, the ISI now systematically targets and exploits vulnerable, ordinary Indian youth. It manipulates their economic anxieties, transforming unsuspecting smartphone users into decentralized, low-cost assets executing pocket-money treason from their own neighbourhoods.

ISI – Genesis and History

The Directorate for ISI was established in 1948 as a direct consequence of the 1947–48 Indo-Pakistani War. During that initial conflict, Pakistan deployed armed tribal lashkars as a frontline vanguard to mask the direct operational involvement of its regular military troops.

There were serious coordination breakdowns between Pakistan’s Military Intelligence (MI) and the civilian Intelligence Bureau during this campaign, exposing critical gaps, prompting the state to centralize its apparatus. The resulting entity was structurally weaponized to unify tri-service military intelligence with a core, institutionalized mandate centred on countering India.

The classic modus operandi of this era relied heavily on high-cost, high-risk operations defined by massive financial investments and weapons smuggling pipelines. To execute these operations, ISI systematically infiltrated trained foreign nationals across the Line of Control (LoC) and other porous borders. These assets primarily included Pakistani operators, battle-hardened Afghan Mujahideen, and mercenaries recruited from Central Asian nations like Uzbekistan. Supported by heavily armed, centralised sleeper cells, these cross-border networks were strategically deployed to destabilize regional security and sustain long-term insurgencies within Indian territories.

High-Cost, High-Risk Operations: This phase demanded massive financial investments to bankroll sophisticated weapons smuggling pipelines and heavy ammunition stockpiles across the border. By establishing centralized sleeper cells within urban centers, the agency accepted extreme operational exposure, banking on high-impact sabotage and logistical longevity to tie down Indian security infrastructure. ISI also generated and used drug money in financing the terrorists outfits and their operations.

The Strategic Pivot – Why the Old Model Failed

India’s strengthening of the Line of Control (LoC), through fencing, surveillance technology and layered counter-infiltration measures, has made traditional cross-border infiltration increasingly difficult and costly.

Simultaneously, international scrutiny raised the diplomatic and financial costs of Pakistan-linked terrorism. Pakistan was placed on the FATF grey list in 2018, while inadequate progress on its action plan created the risk of escalation to the FATF’s public statement, commonly described as the “black list.”

India has actively exposed and highlighted Pakistan’s terror-financing concerns in international forums.

The Strategic Shift

These constraints have increased the attractiveness of methods that require less physical infrastructure. Digital platforms, encrypted communications and online propaganda can facilitate recruitment, radicalisation, financing and coordination at comparatively low logistical cost.

For India, this has expanded the counter-terrorism challenge beyond the LoC into the digital domain. The emerging contest therefore increasingly combines physical border security with efforts to detect, disrupt and attribute online radicalisation and Pakistan-linked influence operations.

Recruitment Beyond Demographics and Religion

Modern digital subversion operates as an equal-opportunity threat. Recent investigations by India’s National Investigation Agency (NIA) and various state Anti-Terrorism Squads (ATS) reveal that digital traps do not discriminate by religions.

Arrests across India show Hindus, Muslims, and Sikhs alike falling prey to hostile handlers. This indicates a paradigm shift where adversaries prioritize vulnerability and access over a target’s religious or cultural background.

To cast this secular net, handlers deploy divergent recruitment pathways tailored to specific psychological profiles. The Ideological Route exploits domestic grievances and hyper-communal narratives to radicalize targets. Conversely, the Apolitical Route is entirely transactional. Handlers prey on widespread unemployment, poverty, or sheer financial greed, turning vulnerable citizens into insider threats through monetary rewards. For instance, several low-income youths and contract workers have been arrested for photographing sensitive infrastructure simply to earn quick digital payments.

Honeytraps

Finally, the Honey-Trap Route utilizes fake female profiles on social media platforms to manipulate lonely youths, defense hobbyists, or low-ranking security personnel. A prominent example includes the multi-state espionage cases where Indian Navy personnel were compromised via social media and blackmailed for leaking sensitive information.

Similarly, high-profile arrests of defense handlers and researchers, such as cases involving DRDO scientists and border-state residents, underscore how emotional manipulation and psychological grooming are weaponized to bypass national loyalty, proving that the digital threat environment is defined by strategic exploitation rather than ideology.

Anatomy of the Modern Cyber Trap – Step-by-Step Modus Operandi

While traditional intelligence operations historically relied on highly trained, deeply embedded espionage operatives, the digital age has democratised state-sponsored subversion. The shifting landscape of cross-border infiltration no longer demands physical crossings or complex deep-cover identities. Instead, hostile intelligence agencies have weaponized everyday technology, turning smartphones, digital payment apps, and algorithms into tools of warfare.

To understand how ordinary citizens, local labourers, and unsuspecting social media users are weaponized against their own country, it is critical to dissect the highly structured, predatory pipeline that defines modern hybrid warfare.

Step 1 – The Initial Digital Footprint: ISI-backed syndicates (like the notorious Shahzad Bhatti network) map Indian youth using automated tools to scan profiles showing financial distress, job searches, or specific geographical location tags near cantonments.

Step 2 – The “Engagement” Hook: Fake profiles approach targets by liking their reels, sending casual DMs, or offering small online gigs (e.g., data entry, local photography, freelance journalism). The recruiters also analyse the comments and through comments adjudge their anti-system, anti-government views and then these sentiments are exploited.

Step 3 – The Odd Jobs Economy: The recruit is initially asked to perform completely legal or seemingly harmless tasks—taking photos of a crowded railway station, checking out a public park, buying a local SIM card, or putting up physical posters. For instance, operatives hire ragpickers and daily-wage labourers for ordinary labour tasks that mask sinister motives, such as fixing solar-powered, internet-enabled CCTV cameras on highways near military cantonments to stream live troop movements overseas.

Step 4 – The Micro-Payment Loophole: Recruits are paid paltry sums (ranging from ₹500 to ₹5,000) directly via UPI apps or cryptocurrency. These micro-transactions slip under the radar of traditional anti-money laundering monitoring systems.

Step 5 – The Escalation & Blackmail: Once the person accepts money, the handler demands sensitive information (like army convoy movements or coordinates of vital installations). If the recruit hesitates, they are blackmailed with their financial transaction history, leaving them trapped in treason. The network even extends to digital amplification, dragging in local social media influencers like Jyoti Mehrotra to distribute propaganda, inadvertently turning ordinary citizens into national security liabilities.

Centre bans Shahzad Bhatti Network under UAPA

The government unleashed a massive multi-state crackdown in August, which exposed the sheer scale of the network’s hybrid operations.

Security agencies registered over 80 FIRs and arrested more than 200 operatives across 14 Indian states. The investigations uncovered that the network had graduated from organized crime to full-scale terrorism, acting as a crucial proxy for ISI. The syndicate has been linked to high-profile violent incidents across India, including grenade attacks in Punjab, an IED blast near Ambala’s Baldev Nagar police station, and facilitating cross-border smuggling of drone-dropped weapons, explosives, and narcotics.

The legal landscape of Indian counter-terrorism reached a critical milestone on 16 September 2026.The Ministry of Home Affairs (MHA) issued a historic Gazette Notification formally declaring the Shahzad Bhatti Network (SBN) a banned terrorist organization under Section 35(1)(a) of the Unlawful Activities (Prevention) Act (UAPA). Home Minister Amit Shah reiterated that the ban aligns with the government’s strict “zero-tolerance” policy against cross-border terrorism. The ruling formally identifies the ISI-backed network, operated by gangster-turned-terrorist Shahzad Bhatti from abroad, as a direct threat to India’s communal harmony, democratic structure, and internal security.

The SBN network published hateful digital content to incite petty criminals and vulnerable youth. With the formal UAPA tag, Indian law enforcement and intelligence agencies now possess absolute statutory powers to freeze the financial assets, choke the micro-payment channels, and systematically dismantle the domestic remnants of such sophisticated cyber-espionage apparatus.

The Threat and the Way Forward

The transformation of cross-border espionage proves that India’s national security challenge is no longer a localized border issue; every smartphone is now a potential point of entry for hostile intelligence networks.

To counter this invisible offensive, India urgently requires robust digital counter-measures. Intelligence agencies must launch aggressive public awareness campaigns alongside tech platforms to educate vulnerable demographics. Simultaneously, law enforcement must enforce stricter tracking of micro-UPI and cryptocurrency trails tied to cross-border handlers, paired with proactive social media monitoring. Protecting India’s digital youth demands a unified, tech-driven shield to dismantle these predatory traps before they compromise sovereignty.