New Delhi: The aftershocks of Operation Sindoor are being felt far beyond the Line of Control as Indian intelligence agencies uncover a sprawling espionage network operating deep within the country’s northern heartlands. At least 12 people — including a YouTuber, students, and known smugglers — have been arrested over the past two weeks in connection with alleged attempts to leak military intelligence to Pakistan’s Inter-Services Intelligence (ISI).
The espionage crackdown, which coincides with the military response to the April 22 Pahalgam terror attack, has drawn a disturbing portrait of how civilian targets are being manipulated and recruited. Two women — Haryana-based social media influencer Jyoti Malhotra and 31-year-old Guzala from Punjab — reportedly maintained contact with Ehsan-ur-Rahim alias Danish, a Pakistani intelligence officer stationed at the Pakistan High Commission in New Delhi. Danish was expelled by India on May 13 following allegations of espionage.
According to investigators, multiple individuals had been transmitting troop movement data, base photographs, and strategic coordinates to ISI handlers via encrypted messaging apps and direct digital transfers. The breach became a high-priority issue following the launch of Operation Sindoor, when two Gurdaspur men — Sukhpreet Singh and Karanbir Singh — were caught allegedly relaying sensitive inputs during the conflict.
Digital forensics and financial audits are revealing deeper links between drug smugglers and intelligence agents. “These networks often begin with narcotics and evolve into more dangerous channels of espionage,” said Gurdaspur SSP Aditya. “In several cases, suspects were introduced to handlers during smuggling operations.”
Among the earliest arrests was a duo from Amritsar, Falaksher and Suraj Masih, accused of sharing images of cantonments. They were followed by Guzala and Yameen Mohammad from Malerkotla, who allegedly received UPI payments for classified inputs.
The role of Operation Sindoor in triggering a security review was underscored with the arrest of 24-year-old Nauman Ilahi from Panipat and postgraduate student Devender Singh from Kaithal, who visited Pakistan last year. Singh’s digital trail, including 300 GB of data and suspicious banking records, is now under intensive scrutiny. Authorities say a honeytrap angle is not being ruled out.
Perhaps the most high-profile arrest has been that of Jyoti Malhotra, a YouTuber with over 3.7 lakh subscribers. Her content often showcased cross-border travel under titles like “Indian Girl in Pakistan.” Officials say Malhotra, who met Danish at the Pakistan High Commission while applying for a visa, was being “developed as an asset.” Her visits to both Pakistan and China have placed her under intense investigation during a five-day police remand.
“This is a modern form of warfare,” remarked Hisar SP Shashank Kumar Sawan, “where civilian influencers are exploited to project favourable narratives or gather critical data during military operations like Operation Sindoor.”
The dragnet extended further as two more men — Armaan and Mohammad Tarif — were held in Haryana’s Nuh district. Tarif, a local healer, is accused of providing a SIM card to Pakistani contacts and has allegedly confessed to visiting Pakistan.
In Uttar Pradesh, Shahzad from Rampur was apprehended by the Special Task Force. Officials claim he served as a conduit for smuggling and intelligence leaks, trading in cross-border goods such as cosmetics and spices while feeding ISI agents strategic information.
As India continues its diplomatic push post-Operation Sindoor, the scale of this espionage network underscores the hybrid threats confronting national security. From civilian YouTubers to underground smugglers, the recent arrests paint a sobering picture of infiltration — and the urgent need for vigilance in the digital and physical domains alike.
Leave feedback about this