The recent arrest of Haryana-based YouTuber Jyoti Malhotra and a number of others has revealed a highly sophisticated espionage ring allegedly controlled by Pakistan's Inter-Services Intelligence (ISI) and coordinated within India by a Pakistani High Commission official called Ehsan-ur-Rahim, alias Danish.
Who is Danish?
Danish was a Pakistan High Commission staffer based in New Delhi, formally assigned diplomatic responsibilities but, Indian authorities said, working as an undercover ISI handler. On May 13, 2025, he was expelled from India and declared persona non grata for his alleged association with a spy ring that sought sensitive Indian military and security details.
Danish's activities and role in India
During his posting in India, Danish's role at the High Commission provided diplomatic cover to recruit Indian nationals for espionage. Investigations indicate that he had a lead role in recruitment and handling assets such as Jyoti Malhotra and those who were arrested in Punjab and Haryana. Danish utilized his access to
- Identify and develop Indian nationals with access to sensitive information or the capability to travel to critical locations.
- Organize visas and travel plans for such individuals to Pakistan, where they were briefed and introduced to ISI agents.
- Organize communication through encrypted apps and pseudonyms, which enable agents to avoid being detected.
- Organize payments for intel, including electronic transfers and money, as in the case of other detained persons such as Guzala and Yameen Mohammed.
Why was Danish deported?
Danish was expelled following the discovery by Indian agencies of his direct role in espionage activities not befitting his diplomatic status. He was discovered to be facilitating the collection and transfer of sensitive military information from Indian nationals to Pakistani handlers, most notably following the Pahalgam terror attack and Operation Sindoor in April 2025. His expulsion followed the arrest of several Indian citizens who confessed to working under his command.
How did the espionage loop work?
The spy ring operated through a combination of face-to-face contacts, coded online communication, and clandestine financial transactions.
- Recruitment: Danish recruited likely assets at the Pakistan High Commission, usually in the guise of visa help or cultural functions. Jyoti Malhotra, for example, received an invitation to a High Commission Iftar party where she was observed in close contact with Danish.
- Briefings and Handovers: Assets were dispatched to Pakistan, where they encountered ISI operatives and picked up more instructions. Some, such as Malhotra, also accompanied their handlers to third nations (e.g., Bali) to escape attention.
- Operational Security: The network used encrypted messaging applications (WhatsApp, Telegram, Snapchat) and fake contact names (e.g., "Jatt Randhawa") to disguise communications.
- Information Gathering: Recruiters traveled to sensitive border zones and military bases and even went to defense expositions, gathering and exchanging photos, videos, and strategic information.
- Payment and Motivation: Money incentives were paid for useful intelligence, with payments made online to stay undetected.
Jyoti Malhotra's affiliation with Danish
Jyoti Malhotra, one of the popular travel YouTubers, originally met Danish at the Pakistan High Commission in Delhi back in 2023. She had gone to an Iftar dinner last year at the Pakistan High Commission after accepting what she described as a "special invitation." She later posted a video from the event, which shows her chatting easily with a High Commission official she recognizes as Danish, implying a prior familiarity between them.
He helped her procure and renew Pakistani visas, booked her accommodation in Pakistan, and introduced her to ISI agents such as Shakir and Rana Shahbaz.
Malhotra's frequent border crossings, visits to sensitive areas, and online contacts with Pakistani handlers all indicate her extensive involvement in Danish's circuit.
Government officials say Malhotra had passed sensitive details regarding Indian troop movements and border constructions, spread pro-Pakistan ideology through social media, and had been funded for her work. It has been reported that she had a very close relationship with Danish and had even accompanied him outside the country.
According to allegations, Danish was the person who then brought Malhotra in contact with various Pakistani Intelligence Operatives (PIOs).
The video captures Malhotra being welcomed by Danish when he arrives at the event and escorted to the venue by him. The YouTuber can be heard saying, "I am feeling so happy to see him and the arrangements."
While entering the event, Danish is observed presenting her to other guests by stating, "She is a vlogger and a YouTuber. She is called Jyoti. She has the channel Travel with Jo. She has more than 100k followers."
Towards the end of the video, she is again observed with Danish, who now presents his wife to Malhotra. They can be observed talking about National Day in Pakistan.
The larger network of espionage
Danish's network also crossed Malhotra. Other Indian citizens, like Guzala and Yameen Mohammed, were also recruited and compensated for providing military secrets. The reach of the operation was extensive, covering Punjab, Haryana, and other border states, with assets usually journeying to Pakistan under one cover story or another and being kept in touch with handlers through encrypted means.
In all, the removal of Danish and the arrests of Jyoti Malhotra and others have brought to light an intricate, technology-savvy espionage network that functions on diplomatic cover. The case proves to be the manifestation of new methods of cross-border intelligence operations and weaknesses introduced by social media personalities and cross-cultural connections in the online world.