Exclusive: Inside ISI’s SIM Nexus—How Pak High Commission Enabled Spying, Honey Traps, Fake Trends In India

<p>For the past week, several individuals accused of espionage on behalf of Pakistan have been arrested across various Indian states, including Punjab, Haryana, and Uttar Pradesh. These individuals were allegedly in contact with ISI handlers posted at the Pakistani High Commission &mdash; Ehsan ur Rahim, alias Danish, and Muzammil Hussain, alias Sam Hashmi. After their arrest, it has come to light that these ISI agents posted at the Pakistani High Commission, who were subsequently expelled from India, had been procuring Indian SIM cards through these accused. For example, Arif, arrested from Nuh in Haryana on charges of spying for Pakistan, reportedly told investigating agencies that between 2018 and 2024, employees working at the Pakistani High Commission had asked him several times to provide Indian SIM cards in return for visa facilitation.</p>
<p>As per Intel sources, they were able to track Arif after a previously arrested spy was interrogated. During the investigation, agencies discovered that the number through which Ehsan ur Rahim, alias Danish, was communicating with the individual spying for him was registered under Arif&rsquo;s name. According to intelligence sources, this practice of demanding SIM cards in exchange for visas has been continuously carried out by ISI handlers at the Pakistani High Commission for the past 5 years. Their modus operandi targets less-educated individuals living in rural areas of India who have relatives in Pakistan and are seeking visas to visit them. These individuals are asked by the ISI agents posted at the Pakistani High Commission to procure SIM cards, and in the past two years alone, ISI handlers posted at the High Commission have managed to obtain over a thousand Indian phone numbers via SIM cards.</p>
<p>This raises a critical question: What exactly do the ISI handlers sitting in the Pakistani High Commission do with these Indian SIM cards? According to a source in the Indian intelligence agency investigating the racket, the ISI and its handlers deployed these Indian numbers in five distinct ways.</p>
<p>First, ISI handlers working in the Pakistani High Commission never communicated with their spies using their own Indian numbers. They always used the Indian numbers either provided by visa applicants or their own spies. This way, if a spy is caught, they can plausibly deny ownership of the number, and the investigative agency&rsquo;s accusations would lack substance. Second, since all conversations took place over encrypted platforms like Telegram, Signal, or WhatsApp, there is no call history, and agencies do not find any evidence even if the calls are tapped.</p>
<p>A particularly significant use of these Indian SIM cards by the ISI is to hack the phones of Indian soldiers and Jammu &amp; Kashmir police personnel or to gather confidential information from them. For example, since 2023, spyware being sent to Indian soldiers and police via WhatsApp has always been sent from +91 coded Indian numbers. ISI handlers posted at the High Commission would activate WhatsApp with these numbers and give access to hackers at the ISI Cyber Command Center in Islamabad so they could spy on Indian army and police personnel and hack their phones. According to intelligence sources, since the number has a +91 code and the ISI hacker or handler speaks fluent Hindi &mdash; impersonating an officer from the Indian Defense Department or another agency &mdash; it increases the likelihood that a soldier or policeman would fall for the ruse.</p>
<p>For example, consider the situation after the recent Pahalgam attack, when ISI agents across the border called many Indian soldiers and their family members seeking information about troop movements. All these calls came from Indian +91 numbers via WhatsApp. Similarly, toll plaza employees in Punjab received calls from ISI PIOs using Indian +91 numbers to ask for information on military movement. According to intelligence sources, ISI has a dedicated call centre located at its Islamabad headquarters and in Pakistan&rsquo;s Jhelum district, whose sole job is to use Indian numbers obtained from handlers at the High Commission to activate WhatsApp and spy on Indian soldiers and even entrap them in honey traps.</p>
<p>According to intelligence sources, ISI always exercises caution so that its nefarious activities are carried out without raising suspicion. While there are many applications and websites today that sell eSIMs with any country&rsquo;s code, ISI fears that if they use such apps or websites to obtain eSIMs, and the purchase data is handed over to Indian agencies, their operations could be compromised. That&rsquo;s why ISI handlers posted at the High Commission operate the SIM card racket.</p>
<h3 class=”p1″><strong><span class=”s1″>ISI’s Misinformation Campaign On Social Media In India</span></strong></h3>
<p>The fourth reason behind this SIM card modus operandi, according to intelligence sources, is that ISI has been running a misinformation campaign on social media in India for several years now to incite civil unrest or promote its agenda. These Indian SIM cards also play a crucial role in such operations. For instance, on the day of the Ram Mandir consecration, the hashtag #BabriZindaHai was trending on X (formerly Twitter) and Facebook. Thousands of people tweeted on this trend, but reverse analysis revealed that the first tweet came from Pakistan, where the hashtag was introduced. Later, 70% of the tweets showed Indian IP addresses, making the hashtag a trend in India. However, most of the X accounts from which these 70% of tweets were made either had a Pakistani cricketer or politician as the display picture or had previously only tweeted in Urdu on topics related to Pakistan. According to intelligence sources, such misinformation campaigns are also carried out using these Indian numbers, making it appear to the world that such dissent is originating organically within India and that Indian users are posting and trending these hashtags.</p>
<p>This was just one example &mdash; ISI has run similar misinformation campaigns over the past 5 years, including after the Pahalgam attack and <a title=”Operation Sindoor” href=”https://news.abplive.com/topic/operation-sindoor” data-type=”interlinkingkeywords”>Operation Sindoor</a>, and is still doing so. According to intelligence sources, ISI could have run these misinformation campaigns using VPNs, simply by selecting India as the location, but that would expose them during reverse IP analysis. So, using Indian SIM cards and a bot network facilitated through the High Commission, ISI handlers run entire misinformation campaigns within India using Indian-registered SIM cards.</p>
<p>Finally, and most dangerously, the modus operandi of these SIM cards connects ISI to terrorist networks. According to intelligence sources, ISI handlers and Terror commanders based in Pakistan also use these Indian SIM cards to activate WhatsApp, Telegram, Signal, or other encrypted apps to communicate with terrorists infiltrating India. For example, in the Pulwama terror attack, investigations by intelligence agencies revealed that handlers sitting within Pakistani territory were communicating with the terrorists using Indian SIM numbers via encrypted applications. According to intelligence sources, a similar pattern has been consistently observed over the past seven years. This ensures that if they are killed or captured in an encounter, there remains no traceable link to Pakistan. As per Intel Sources, these terrorists also receive many of their numbers through the High Commission&rsquo;s SIM card modus operandi.&nbsp;</p>