As India sees a spike in espionage-related arrests, intelligence agencies are turning their focus to a sophisticated Pakistani operation — Unit 412, a specialised wing of Pakistan’s ISI (Inter-Services Intelligence), headquartered in Karachi. Allegedly responsible for a wide range of espionage and psychological warfare activities, this unit is said to run honey traps, control fake social media accounts, and recruit individuals to extract sensitive Indian intelligence, all with an estimated annual budget of ₹4,000 crore.

The recent arrest of Hanif Khan by Rajasthan Police on spying charges is the fourth such arrest in Jaisalmer this year. This surge of arrests aligns with warnings issued by Indian intelligence agencies following Operation Sindoor.

Officials claim the rise in arrests is no coincidence; rather, it’s evidence that the ISI has ramped up operations in India, deploying more resources and personnel to gather critical intelligence through covert channels.

What is ISI’s Unit 412?

Unit 412 is described as a multi-functional espionage arm of ISI. Based in Karachi, the unit oversees a network that:

  • Runs honey trap operations using trained female operatives.
  • Controls thousands of fake social media accounts to spread misinformation.
  • Recruits Indian citizens using money, blackmail, or coercion.
  • Employs influencers to present pro-Pakistan narratives online.
  • Aims to manipulate public opinion and damage India’s global image.

According to intelligence sources, female operatives are trained and given Hindu names to move unnoticed in Indian Army circles. Their mission is to build relationships with defence personnel and extract classified information.

These women are often seen at social or military gatherings, posing as civilians. Once a target is identified, operatives attempt to establish contact and slowly gain their trust, often leading to compromising situations that are used for blackmail.

Social media plays a crucial role in these operations. Unit 412 reportedly floods Indian officials with friend requests from fake profiles featuring provocative images. Once accepted, operatives begin a carefully orchestrated manipulation campaign.

Indian agencies estimate that ISI allocates nearly ₹4,000 crore annually to fund units like 412. This covers:

  • Salaries for agents and handlers.
  • Maintenance of digital infrastructure for fake accounts.
  • Travel, accommodation, and operational costs for field agents.
  • Payments to influencers and informants.

Disinformation blitz: Weaponising social media

During Operation Sindoor, Indian agencies observed a sharp increase in fake social media posts allegedly managed by Unit 412. These posts claimed heavy Indian Army losses, even though such reports were inaccurate or fabricated.

The goal, intelligence officials say, was clear: erode public trust in the Indian military, amplify internal dissent, and cover up Pakistani Army failures.

In some cases, Indian social media influencers were recruited to produce content portraying Pakistan positively. This content was later used by ISI to claim that India was spreading false propaganda against Pakistan, a tactic known as reverse narrative laundering.

Espionage isn’t limited to civilians. Officials warn that government personnel and uniformed officers are often the primary targets.

On April 22, a CRPF Assistant Sub-Inspector, Moti Ram, was arrested for allegedly spying. The National Investigation Agency (NIA) is probing whether he passed on critical information about Pahalgam to terrorists.

Previously, ISI’s honey trap modules operated from locations like Faridkot in Pakistan. Post-Operation Sindoor, these hubs have reportedly been moved to Karachi to centralise command and control.

This consolidation mirrors Pakistan’s larger strategy of coordinating terror modules and espionage cells from secure urban zones far from the border, making counterintelligence operations more complex for Indian agencies.