ISI Exploits Social Media for Espionage Recruitment in India

Severity: Medium (Score: 57.0)

Sources: Lokmattimes, Thehawk.In

Published: 2026-05-28 · Updated: 2026-05-28

Keywords: espionage, likes, followers, recruitment, model, delhi, number

Summary

The number of arrests related to ISI-backed espionage in India has surged over the past year. The ISI employs social media tactics to recruit spies, particularly targeting individuals who create engaging content. Recruiters based in Pakistan monitor social media users, creating fake accounts to boost engagement and lure them into espionage. Victims, often unaware of the true nature of their actions, are manipulated into gathering sensitive information for small payments or other incentives. A notable case involves Zaid Khan, who was arrested for attempting to collect sensitive contact information for a government official in Uttar Pradesh. The ISI's strategy resembles influencer marketing, leveraging social media dynamics to exploit vulnerable individuals. The situation remains under investigation, with authorities highlighting the risks posed by these recruitment tactics. Key Points: • ISI has increased recruitment of spies in India through social media engagement tactics. • Fake accounts are used to manipulate social media users into espionage activities. • Arrests have risen significantly, with individuals unaware of their involvement in espionage.

Detailed Analysis

**Impact** Individuals creating social media reels across India are targeted, with a notable case involving a resident of Uttar Pradesh arrested for espionage. The scope includes sensitive information related to political figures such as the Uttar Pradesh Chief Minister’s Personal Assistant and various Cabinet ministers. The espionage network aims to gather intelligence on India’s Defence sector, particularly after 'Operation Sindoor,' increasing risks to national security and government operations. Arrests related to ISI-backed espionage have increased substantially over the past year. **Technical Details** The attack vector involves social media platforms where ISI recruiters use fake accounts to engage with individuals making reels, boosting their engagement to lure them into espionage activities. Tactics include social engineering to build trust, followed by requests for sensitive information and small payments or material incentives. No malware, CVEs, or specific infrastructure details are mentioned. The kill chain stages primarily involve reconnaissance, initial contact, and exploitation through manipulation and recruitment. **Recommended Response** Monitor social media platforms for suspicious engagement patterns, particularly involving new or fake accounts interacting with content creators. Increase scrutiny on individuals posting location-specific content or requesting sensitive information. Intelligence agencies should enhance surveillance of social media influencers and ordinary users with rapidly growing engagement. No specific patches or malware detections are applicable based on current information.

Source articles (2)

• Likes, followers and espionage: The ISI's new recruitment model — Lokmattimes · 2026-05-28
  New Delhi, May 28 The number of arrests in connection with ISI-backed espionage cases has gone up substantially in the last one year. The ISI has been resorting to various tactics to appoint spies in…
• Likes, followers and espionage: The ISI's new recruitment model — Thehawk.In · 2026-05-28
  New Delhi, May 28 (IANS) The number of arrests in connection with ISI-backed espionage cases has gone up substantially in the last one year. The ISI has been resorting to various tactics to appoint sp…

Timeline

• 2025-05-28 — Surge in ISI espionage arrests: The number of arrests linked to ISI-backed espionage in India has significantly increased over the past year, highlighting a growing trend.
• 2025-05-28 — Zaid Khan arrested for espionage: Zaid Khan was arrested for attempting to gather sensitive information for ISI handlers, illustrating the recruitment method's effectiveness.

Related entities

• Operation Sindoor (Campaign)
• India (Country)
• Pakistan (Country)