Hisar: Every morning, Haris Malhotra quietly takes his BP medicine in his Hisar home. For the past three days, his anxiety has gotten worse. Visibly frail, his hands twitch restlessly, fingers tugging at each other, feet tapping the floor. On Thursday night, the police took his 33-year-old daughter Jyoti away.
She returned at 2 am on Friday morning—only to be taken again a few hours later, along with her phone and laptop. The police also took with them the phones of her father and uncle, and her father’s notebook tracking daily expenses.
Harish hasn’t eaten, only sips water, repeating before a swarming media: “Dost hona Pakistan mein koi gunaah thodi hai.”
His brother lies silently in Jyoti’s room, waiting for her to return. Jyoti has been accused of spying for Pakistan. She has been booked under the Official Secrets Act and Section 152 of the Bharatiya Nyaya Sanhita (Acts of endangering sovereignty, unity and integrity of India), and sent to five-day police remand.
Dost hona Pakistan mein koi gunaah thodi hai
– Haris Malhotra, Jyoti’s father
“If there’s solid proof against my daughter, then she’s done wrong—and she should be punished,” said Jyoti’s father.
What began as a young woman chasing internet stardom has spiraled into a chilling saga of alleged espionage — with national implications and personal heartbreak. But Jyoti is not alone. A quiet storm of suspicion is sweeping through Haryana. Devendra Singh of Kaithal, Nauman Ilahi of Panipat, Armaan of Nuh, and Harkirat Singh of Kurukshetra have been accused of spying for Pakistan.
Recalling his daughter’s trips a couple of years ago, Haris, 59, said he “never asked where she went. She’d just said, ‘I’m going away for 5-6 days,’ and that was it.”
Since Thursday, when the police came looking for her, the father has been trying to piece together what went wrong.
According to the FIR filed by Hisar Police, she came in contact with Ehsan-ur-Rahim alias Danish, a staffer at the Pakistan High Commission in Delhi and an alleged ISI handler. She visited Pakistan twice in 2023, met ISI operatives, and stayed in touch with Danish through encrypted apps.
Danish was expelled earlier this month for having links to a “spy-ring” and was declared persona non grata, after Punjab Police arrested two people from Malerkotla who were allegedly providing him sensitive information in exchange for money.
Operation Sindoor is far from over. People are claiming that perhaps this is what Prime Minister Narendra Modi hinted at when he said the mission would continue — and now, with police and intelligence agencies intensifying efforts to dismantle the network of suspected spies, that statement appears to be taking shape.
Harkirat, an employee at the Haryana Sikh Gurdwara Management Committee (HSGMC) headquarters in Kurukshetra and in-charge of the Yatra department managing Sikh Jathas to Pakistan, was recently picked up by the STF Hisar. Though released Sunday night, police confiscated all his electronic devices before letting him go. He was the one who introduced Jyoti to Danish.
In the case of Devendra Singh, Kaithal Superintendent of Police Astha Modi said they have extracted 300 GB of data from his electronic devices, adding that he was in touch with Pakistani intelligence officials.
Speaking to ThePrint about the series of arrests, sources in the security establishment said that Pakistan has nurtured several such assets to pass on seemingly minor information, which may prove critical during times of conflict. While these individuals may not be providing highly sensitive or classified intelligence regarding defence establishments, troop movements, or installations, even small fragments of information can become significant when they help complete a larger picture.
‘Psychological warfare’
In a cramped 55-yard house in Hisar, lined with peeling paint, Jyoti Malhotra’s room is the only space that feels alive. Posters of popular sitcom Friends hang on the walls of her room with a silver YouTube Creator Award and a quirky poster that reads, “Peene ke hain chaar din.”
This is the room where Jyoti made videos for her 3.85 lakh YouTube subscribers. But now, it’s at the centre of a much bigger and darker story — one that reaches from Hisar to Islamabad.
People have begun assassinating her character, clinging to the little they claim to know. “She used to roam around in T-shirts and pants,” one neighbour said dismissively. Another added, “She would wander around at night in shorts after drinking. Ask her father who all used to come and go from their house.”
According to sources in the security establishment, who requested anonymity, Jyoti was allegedly working for Danish. The Indian government on 13 May declared him persona non grata for “activities not in keeping with his official status” — a diplomatic euphemism often used when someone is suspected of espionage. It was at the High Commission that Jyoti first met Danish.
Her first trip to Pakistan was in 2023, where she filmed a YouTube video featuring Maryam Nawaz Sharif, daughter of Nawaz Sharif and Chief Minister of Punjab. The same year, she was invited to an Iftar party hosted by the Pakistan High Commission, where Danish introduced her to his wife and other senior officials.
In the video, Jyoti is seen meeting Maryam Nawaz at the Sri Kartarpur Sahib gurdwara and telling her that Ramesh Singh Arora, first Sikh minister in Pakistan’s Punjab province, “made wonderful arrangements for visitors”.
“There is also a psychological warfare aspect,” said the source in the security establishment quoted above. “Pakistan has cultivated individuals here to either amplify or create content that could go viral across the border—for example, videos allegedly showing damage caused by Pakistani attacks in India. There are several such individuals, including stringers, who are recruited and paid small sums by handlers to help shape a counter narrative.”
Sources quoted above claim that Danish, believed to be an ISI agent, handed Jyoti a series of subtle but significant tasks: projecting Pakistan in a positive light through her content, reshaping narratives about the country, and recruiting others to do the same. During Operation Sindoor, Jyoti is alleged to have shared details of the developments in the Indian cities after the operation.
One of her more concerning moves, officials mentioned above say, was arranging for a Kashmiri YouTuber to meet Danish — someone who could also help propagate these curated narratives and pass on information to the Pakistani High Commission.
A name that keeps coming up in FIRs is Ali Ehwan, a Pakistan-based known associate of Danish, who reportedly arranged Jyoti’s travel and stay during her first visit to Pakistan. Ehwan allegedly introduced her to alleged Pakistani security and intelligence officials, including Shakir and Rana Shahbaz.
Over the last three years, Jyoti traveled frequently to countries such as Indonesia, Bhutan, Thailand, Dubai, China, Bangladesh — for content creation. In January this year, she was in Pahalgam, Kashmir. Her vlogs from the valley were as scenic as ever, but they’re now being reviewed with a new lens.
“I don’t like her making these videos. I tell her, you may be getting fame, but it brings me shame in the society. People come to me showing your videos”
– Haris Malhotra, Jyoti’s father
“Danish was subtly grooming her as a tool of soft propaganda, using her to shape a narrative without her even realizing it. She still believes she was simply exercising her freedom of speech,” said Hisar SP Shashank Kumar Sawan.
While Jyoti did not share any classified military information, officials from the NIA and Military Intelligence (MI) noted that her role fits within the broader framework of ‘psychological warfare’, and investigations are ongoing in coordination with local police.
In Hisar, the neighbors had always whispered. “This girl’s behaviour was never right. We had suspected her from the beginning,” said a 58-year-old lady living in the neighbourhood. “She would come and go, and no one knew who visited her home or when.”
Jyoti was raised by her father and uncle. Haris now sits in quiet disbelief, often repeating how her work never sat well with him.
“I don’t like her making these videos. I tell her, you may be getting fame, but it brings me shame in the society. People come to me showing your videos,” he said bitterly. He also worries about her age and marriage prospects. “Only a 55-year-old man will marry her now.”
The Punjab Police on 11 May arrested two persons, including a woman, on the charges of spying and leaking defence-related information to Danish.
Police officials said that Yameen, who runs a travel agency and visa consultancy in Barnala district, acted as a “cash courier” between Danish and Gujala.
Gujala, a 31-year-old woman, was seeking to travel to Pakistan and had visited the Pakistan High Commission on 27 February.
“Their friendship developed quickly and soon shifted to Telegram. She was cultivated as a source to support a larger espionage module. They remained in constant contact, with Yameen’s bank account being used for online fund transfers between them. Gujala also retained a portion of the funds while transferring the rest to Danish’s other associates, following his instructions,” an investigator told ThePrint.
However, officials declined to specify the kind of “sensitive” information that the duo, or the larger module, may have passed on to Danish, which was subsequently shared with the Pakistan government.
“Gujala last met Danish on 23 April, a day after the Pahalgam terrorist attack. She has admitted to receiving Rs 10,000 on Yameen’s instructions, and Rs 20,000 directly from Danish,” the officer quoted above said.
When asked about the possible sources of “classified information” accessed by the accused, officials explained that “not all sources are cultivated for the direct exchange of intelligence”.
“Some are developed to expand the network and identify potential informants who can provide additional sensitive information. In this case the woman appears to be part of that nexus,” the official added.
Also read: Tamil Nadu’s Anganwadi workers are drowning in data duties. Apps, OTPs & digital surveillance
‘Personal opinion and influence’
Jyoti built an online persona through a series of travel vlogs centered around Pakistan. One of her most-watched videos, titled “Indian Girl Crossing Wagah Border”, shows her traveling in a modest economy-class train through Wagah village while singing, “O lagdi Lahore di aa, jis hisaab naal hasdi aa.” In the same video, she explains to her audience how to navigate immigration, exchange currency, and cross the border with ease.
Her content explored the vibrant streets of Lahore’s Anarkali Bazaar, the largest Hindu temple in Pakistan, and offered detailed glimpses into the country’s public transport—its buses and railways. In one video, she did a 10-day trip in Pakistan “only in Rs 5,000.”
After the Pahalgam terror attack, Jyoti stated that “neither India nor Pakistan is to blame”, a comment that many viewed as controversial.
Back home, Jyoti also promoted fashion boutiques across Delhi in her videos. According to a viewer, “Glamour content goes viral”, referring to the kind of visuals she often used—bright and bold. Another added, “Her videos are eye-catching,” crediting their virality to a blend of glamour and travel storytelling.
A senior police official added that she appeared to be brainwashed and gradually groomed as a potential asset for Pakistan. “Her actions may have stemmed from naivety, but in doing so, she inadvertently advanced a narrative that served hostile interests. She blurred the line between personal opinion and influence—between who might be a friend and what might be a threat.”
Also read: Haryana women mountaineers want the Vinesh Phogat life. ‘We’re like wrestling daughters’
More cases
Nauman Ilahi, a private security guard from Kairana, Uttar Pradesh, according to police, had the job of monitoring the Panipat railway station and report on Army movement—for Pakistan.
The Delhi-Jammu route, used frequently by military trains, runs straight through Panipat. Police said his phone has been seized and that the investigation is ongoing. Ilahi allegedly got Rs 6,000-7,000 for sharing one video. The 24-year-old was arrested in Panipat, Haryana, for allegedly passing sensitive military information to contacts in Pakistan.
Police said Ilahi was disguising himself as a factory guard. “He would share details with a man named Iqbal, alias Kana — the number of soldiers on board, the type of weapons, what kind of force trains were moving,” said DSP Satish Kumar of Panipat. “Sometimes he even sent inputs from Delhi and Ambala.”
Many of these individuals, including content creators who have traveled to Pakistan, have long been on the radar of intelligence agencies in India. However, amid the current tensions between India and Pakistan, their activities have gained new relevance, said the source in the security establishment quoted earlier in the article. Any information they disseminate could have serious consequences, making these arrests “necessary,” added the source.
Ilahi had been working in the industrial belt of Panipat Sector 29, an area divided into Part 1 and Part 2. Locals of the area claimed he was posted at Divine Corporation Blanket Factory, unit number 82 in Part 1. But when ThePrint visited the site, it was learned that factory number 82 in Part 1 has been shut for the last 3–4 months and there was no 82 in Part 2.
“Factory number 82 in Part 1 has been shut for the last 3–4 months, and it’s called Mona Industries,” said a local worker. “And there’s no 82 number factory in Part 2 at all.”
“He was employed in the same industrial area,” DSP Kumar clarified, “but we’re withholding the exact factory and location for security reasons.”
The man on the other side of the alleged espionage chain — Iqbal alias Kana — was once Ilahi’s neighbour in Kairana. He had been deported to Pakistan years ago on charges of spying. Both Iqbal’s and Ilahi’s families migrated from Pakistan to India in the late ’90s. According to police, Iqbal is believed to have “brainwashed hundreds” in the Kairana region and built a covert network over the years.
“Many more people from the area are now on our radar,” Kumar said, adding that Ilahi had no prior criminal history. Police also revealed that Ilahi last visited Pakistan in 2017.
From Ilahi’s house in UP, Kairana, police recovered six passports — two belonged to his parents, one to another family member. The remaining three are under investigation. But what stood out most was a voice note from Ilahi’s phone. In it, someone asks, “Sena ja rahi hai kya? Sena ka samaan kya hai? (Is the army moving? What equipment are they carrying?)”
Back in Panipat, at his sister’s home where Ilahi had been staying, a different story is quietly unfolding. Neighbours speak in hushed tones of a mysterious diary Ilahi once mentioned to his sister after his arrest. “He told her, ‘Look for that diary. If they find it, I can be saved,’” one of them recalled. But when police searched the house, no such diary was found.
“These are just rumours,” Kumar dismissed. “We don’t know anything about a diary.”
Meanwhile, Ilahi’s sister, Zeenat (32), who has lived in Panipat for 16 years with her husband and extended family, has been falling ill since his arrest. Her husband has been regularly taking her to the hospital. The neighbourhood has rallied around her, offering support in hushed solidarity.
Zeenat’s sister-in-law scrubbed the floor of their over 30-year-old home in Hali colony, Panipat, with quiet desperation. Ever since the police and media began showing up, she had buried herself in chores—anything to escape the weight of judgement from neighbours and strangers alike.
“He’s not my brother,” she muttered, refusing to utter his name. “His sister is in the hospital… the media drained every ounce of strength from her.”
Outside, children gathered near the gate. “Kya tamasha chal raha hai yahan?” she snapped, sending them running.
A neighbour, one of Zeenat’s friends, whispered, “She’ll either die of despair, or take her own life.” And her sister-in-law didn’t disagree—just kept scrubbing, as if cleaning could somehow make it all go away.
Munesh Devi, in her late 60s, the self-declared sarpanch of Hali Colony, spoke sharply against Zeenat’s family. “That boy had been coming here for the past four to five months. He used to get his clothes washed by his sister. Everyone connected to them should be investigated,” she said. She also insisted that Zeenat’s neighbour, a Muslim woman, should be placed under surveillance as well.
“One person’s actions can’t be used to blame the entire Muslim community. There are many Muslims living here—we all, as women, work together and sit together in harmony,” said Santosh, a local resident in Panipat.
Meanwhile, others in the colony have called for strict verification of all residents, insisting that anyone who moves in must be thoroughly vetted.
With inputs from Mayank Kumar.
(Edited by Aamaan Alam Khan)
This is what happens to people obsessed with fame, glamour and money. No wonder the father had no idea what his daughter was up to.
Social media has been a curse for Indian society. Young women are especially vulnerable.
If only the father had married her off at the right age, he would not have to go through this now.