IB flags ISI’s new impersonation spy tactic targeting Indian Army and police personnel

New Delhi, October 24, 2026: The Intelligence Bureau (IB) has alerted security agencies to a new espionage technique being used by Pakistan’s Inter-Services Intelligence (ISI), in which forged communication channels are created to impersonate senior Indian Army and police officers and pressure junior personnel into sharing sensitive information.

The warning comes in the wake of the arrest of a husband-and-wife duo from Kalu Wala village in Punjab’s Ferozepur district, described as the last village along the India-Pakistan international border. Army Intelligence, working with the police, arrested the couple in connection with what investigators say was an ISI-linked network that gathered and passed on highly sensitive information about Indian Army installations and activities.

According to the investigation, the material allegedly transmitted included maps of military locations, details of weapons and ammunition depots, cantonment areas, troop movements, deployments in border regions, and information on military preparedness and security arrangements. A case has been registered under Sections 3 and 4 of the Official Secrets Act, 1923. Several mobile phones have been seized, and investigators are now examining the devices for leads on handlers believed to be operating from Pakistan and Malaysia.

Officials said the woman in the couple allegedly posed as a police officer and used social media platforms such as Instagram and Snapchat to establish contact with Army personnel. She is suspected of trying to draw some of them into relationships as part of a honey-trap operation aimed at obtaining confidential information. Investigators also believe the couple shared border-related classified information with Pakistan-based smugglers.

How the new tactic works

An IB official said honey-trapping has long been part of the ISI’s playbook, but the latest development is the growing use of impersonation to strengthen such operations. Under this method, recruited individuals create communication channels that appear to belong to senior police or Army officers. These channels are not activated immediately. Instead, operators watch for junior officers who may be vulnerable to pressure or deception.

After remaining inactive for some time, the forged channels are used to send messages that convey a strong sense of urgency. The idea is to create an artificial emergency and push the recipient to respond quickly without verifying whether the source is genuine.

“When an artificial emergency is created, the junior officer tends to pass on information almost urgently. The officer tends to prioritise the urgency rather than cross-checking whether the communication channel is genuine or not,” an official said.

In some instances, such messages have allegedly been used to push lower-ranking personnel to bypass established procedures or grant access to unauthorised networks while sharing sensitive information. Once the required data has been obtained, the forged channel is immediately closed.

Officials said the short lifespan of these networks makes them difficult to trace. Since the impersonation channel may be used for only one operation before being dismantled and replaced by another, security agencies face added difficulty in identifying the masterminds or linking separate modules together. Investigators have described this as a “fresh challenge.”

Post-Operation Sindoor shift

Security assessments indicate that this evolution in ISI tactics has become more pronounced since Operation Sindoor in May 2025, which was launched in response to the Pahalgam terror attack. During and after the operation, India demonstrated military strength while also gaining an intelligence advantage. Several ISI modules and honey-trap networks were broken up, and Pakistan has reportedly struggled to revive many of its proxies or sustain infiltrations.

According to these assessments, the setbacks appear to have forced the ISI to adapt by setting up short-lived impersonation networks that can extract as much information as possible about the Indian armed forces before disappearing.

Security agencies are continuing to probe the full extent of the Ferozepur network and whether more such modules are active. The development has renewed concern over the need for personnel in the Army and police to verify urgent communications carefully, especially when the messages claim to originate from senior officers and are received in border areas.