IAF Wing Commander Accused of Planting Spyware in Espionage Linked to Pakistani Intelligence

New Delhi, August 9, 2026 — A Wing Commander in the Indian Air Force, arrested earlier this year on suspicion of leaking sensitive defense information, is now facing allegations of installing data-stealing software on a colleague’s mobile phone. This act is believed to be part of an espionage operation possibly linked to Pakistani intelligence. The 44-year-old officer continues to be held in Tihar Jail after a chargesheet was filed under the Official Secrets Act.

Sources from the Delhi Police and the Indian Air Force have revealed that the officer, stationed at a critical unit on the Western Front, was ensnared in a social media honey trap by a woman allegedly working with Pakistani handlers. It is claimed she convinced him to share sensitive military documents and operational details and to install spyware on another officer’s device, aiming to widen access to classified information.

Senior officials from the Delhi Police have disclosed that the Wing Commander was first contacted on social media earlier in 2026 while he was undergoing personal difficulties. Their exchanges evolved from casual chats to regular video calls and communications via encrypted messaging apps. Once trust was gained, the woman started asking for photographs, videos, and information about troop deployments, military movements, and strategic activities along the border.

Investigators assert that the officer transmitted vital documents and data through digital means. The operation escalated when his handler directed him to install an application on a colleague’s phone. Described by police as targeted spyware or remote-access malware, the app was designed to steal data, track locations, and intercept communications. This installation was intended to give external handlers broader access to information on the second officer’s device.

The technical specifics of the software and the extent of data, if any, extracted through the app remain under forensic scrutiny. Agencies are evaluating whether the malware successfully breached the colleague’s phone and the national security implications of any such intrusion.

Monitoring by the Delhi Police Special Cell began in January 2026 after an international number linked to Pakistani intelligence was found to be in frequent encrypted communication with an Indian number, later identified as the Wing Commander’s. The IAF’s counter-intelligence units placed the officer under both physical and digital surveillance.

Over the ensuing months, sufficient evidence was gathered. On May 30, 2026, IAF authorities filed a formal complaint, and the officer was handed over to the Delhi Police Special Cell. Initially detained in police custody, he was transferred to judicial custody in Tihar Jail in June. A comprehensive chargesheet was filed before a competent court, identified in reports as the Saket court, on July 30, 2026. The case remains under judicial review.

A Delhi Police statement confirmed the arrest on May 30, 2026, following a complaint by Indian Air Force authorities. The statement noted that a charge sheet was submitted on July 30, 2026, and that the matter is sub-judice.

According to an IAF spokesperson, the officer was "under active surveillance and was handed over to the suitable law enforcement agencies." The spokesperson highlighted that proactive measures were taken to mitigate the leak, underscoring the Air Force's zero-tolerance policy toward security breaches and espionage.

Police sources describe the incident as part of a broader espionage network aimed at obtaining strategic military intelligence. Authorities are investigating the digital communication trail to identify potential overseas handlers, assess the extent of compromised information, and determine if the woman contacted other IAF personnel.

This case is part of a recurring pattern of suspected Pakistani intelligence operations targeting Indian defence personnel through social media, emotional manipulation, and malware. A similar incident was reported in February 2018 when an IAF Group Captain was arrested after being honey-trapped via a fake Facebook profile and accused of passing classified documents related to defence space and cyber agencies.

Security agencies have pointed out that even fragmented information on deployments, movements, and internal communications can be valuable to foreign intelligence services. Investigators continue to assess whether the information shared or any data accessed through the spyware could have compromised operational security or facilitated hostile activities.

The identity of the Wing Commander remains undisclosed as he continues to be held in Tihar Jail under judicial custody. Investigations by the Delhi Police Special Cell, IAF intelligence, and central agencies into electronic devices, the full scope of the alleged spyware installation, and the potential existence of a broader network are ongoing.

The Indian Air Force has stressed that the officer’s actions were detected through internal surveillance, preventing further damage. As the case moves through the courts, more details about the classified information involved and the technical assessment of the malware are expected to emerge only through the formal legal process.

This report is compiled from official statements issued by the Delhi Police and the Indian Air Force, corroborated by consistent accounts from senior police sources provided to various national media outlets.