ISI using social media friend requests to recruit Indian youth, agencies warn
Synopsis
A friend request is no longer just a friend request. Indian intelligence agencies have laid bare a structured ISI playbook — social media contact, a month of normal chat, a shift to encrypted apps, then a paid task. The Shahzad Bhatti network has already drawn in Indian youth who say they never even knew they were working for a terror outfit.
Key Takeaways
The Intelligence Bureau (IB) has warned that accepting social media friend requests from unknown individuals could be the first step in a terror recruitment process .
Pakistan's ISI has used the Shahzad Bhatti network to identify, groom and recruit Indian youth through social media platforms.
Recruitment follows a three-stage pattern : social media contact, migration to encrypted messaging apps, and assignment of paid tasks including intelligence gathering or targeted attacks.
Recruiters deliberately avoid naming terror outfits like Jaish-e-Mohammed or Lashkar-e-Taiba ; recruitment is driven by money, not ideology .
ISI funds recruits through in-country operatives paid via hawala channels; security agencies are actively tracing the financial trail.
Assam Police investigations and multiple busted modules have confirmed the pattern; large-scale operations to dismantle remaining networks are ongoing.
Indian intelligence agencies have sounded a sharp alert over a structured ISI-backed social media recruitment operation targeting vulnerable youth across the country, warning that a seemingly routine friend request could be the opening move in a multi-stage radicalisation and terror recruitment process. The warning, issued on 28 July from New Delhi, comes as security agencies dismantle several modules linked to the Pakistan-based Shahzad Bhatti network.
How the Recruitment Trap Works
According to officials from the Intelligence Bureau (IB), the recruitment strategy is deliberately gradual. An operative first sends a friend request or follows a target on social media. For nearly a month, only routine conversations take place — building familiarity and trust. Once the recruiter assesses that the target is susceptible, the communication shifts to encrypted messaging applications where covert exchanges occur.
The final stage involves assigning tasks that range from gathering sensitive information to carrying out targeted attacks — all in exchange for money. Critically, officials note that recruiters deliberately avoid mentioning the names of terror outfits such as Jaish-e-Mohammed or Lashkar-e-Taiba during the grooming phase. 'Mentioning names such as the Jaish-e-Mohammed or Lashkar-e-Taiba tends to frighten the youths as these are known terror organisations. This means that the recruitments are not driven by ideology, but money,' an official said.
The Shahzad Bhatti Network: A Case Study
Investigations into multiple Shahzad Bhatti-linked modules busted by security agencies have revealed a consistent pattern. None of the accused questioned so far admitted to knowingly associating with a terror outfit. Most told investigators they performed assigned tasks purely for financial gain, without probing the identity or intent of those directing them.
A probe by Assam Police corroborated this pattern, finding that recruits are first engaged on social media, then migrated to secret chat applications, and finally handed operational tasks. The entire pipeline — from first contact to task assignment — is structured to keep the recruit unaware of the larger network until they are already complicit.
The Money Trail: Hawala and In-Country Operatives
Financial transactions in this network are deliberately insulated from direct ISI contact. According to officials, the ISI maintains operatives inside India who transfer money to recruits. These domestic operatives are themselves paid by ISI handlers through hawala and other covert channels. Security agencies are now conducting targeted operations to identify and apprehend these financial intermediaries, as tracking them is considered critical to establishing a verifiable money trail and dismantling the broader network.
What Security Agencies Are Doing
Officials confirmed that a large-scale operation is underway to dismantle active recruitment networks. Several individuals linked to the Shahzad Bhatti modules have already been arrested. However, the more complex challenge, according to officials, lies in identifying individuals still in the first phase of recruitment — those engaged in what appear to be innocuous online conversations — before they are drawn deeper into the network.
'This is the first phase of the recruitment process, and it would be important to stop them before the Bhatti network makes the next move,' an official noted. The second phase — full ideological indoctrination combined with operational tasking — is described by officials as significantly more dangerous.
Advisory for Social Media Users
The IB has advised all social media users, particularly young people, to verify the background of anyone attempting to connect with them online before accepting requests or following accounts. Even if a request is accepted unknowingly, users are urged to remain alert if the person subsequently attempts to initiate personal conversations or build an online rapport. With a large proportion of India's youth active across multiple platforms simultaneously, officials say the scale of potential exposure makes public awareness a frontline defence.
Point of View
But by cash, with no awareness of who is directing them. That makes detection harder and prosecution murkier. Security agencies are right to prioritise the financial trail, but the deeper policy gap is a lack of structured digital literacy at scale — particularly in states like Assam where several modules have already been busted. Dismantling networks after recruitment is reactive; the first-phase intervention the IB describes requires a public-awareness infrastructure that does not yet exist at the necessary reach.
NationPress
28 Jul 2026
Frequently Asked Questions
How is the ISI using social media to recruit Indian youth?
According to intelligence officials, ISI-backed operatives send friend requests or follow targets on social media, engage in routine conversations for about a month, then migrate the recruit to encrypted messaging apps before assigning paid tasks. The process is designed to keep the recruit unaware of the terror network's identity until they are already involved.
What is the Shahzad Bhatti network?
The Shahzad Bhatti network is a Pakistan-based ISI-linked recruitment module that has been used to identify and groom Indian youth through social media. Several modules connected to this network have been busted by Indian security agencies, with multiple arrests made.
Why don't recruiters mention terror group names like Jaish-e-Mohammed?
Officials say recruiters deliberately avoid naming known terror outfits because doing so tends to alarm potential recruits. The recruitment is described as money-driven rather than ideology-driven, making financial lure the primary tool.
How is money transferred to recruited youth?
ISI operatives based inside India transfer money directly to recruits. These domestic operatives are themselves paid by ISI handlers through hawala and other covert channels. Security agencies are actively working to identify these financial intermediaries to establish a traceable money trail.
What precautions has the Intelligence Bureau advised for social media users?
The IB has advised users to verify the background of anyone attempting to connect with them before accepting friend requests or following unknown accounts. Even if a request is accepted unknowingly, users should remain alert if the person later initiates personal conversations or attempts to build an online relationship.
