The AI Propaganda War: Inside the India-Pakistan Influence Networks
Insikt Group has published a comprehensive study on two influence networks that were active during the conflict between India and Pakistan in the spring of 2025. The report highlights Hidden Charkha, which promoted pro-Indian narratives, and Khyber Defender, which targeted Pakistani audiences. According to analysts, both networks almost certainly operated in alignment with their respective governments, shaping favorable information campaigns while undermining trust in their rivals.
The peak of activity coincided with the period between the Pahalgam attack on April 22 and the ceasefire announcement on May 10. Hidden Charkha accused Pakistan of orchestrating the attack, while Khyber Defender dismissed it as an “Indian false flag,” amplifying hashtags such as #indianfalseflag and #IndiaFalseFlagKing.
Insikt’s findings reveal that Hidden Charkha has been operational since 2021, leveraging over 900 fake accounts, while Khyber Defender has existed since 2020 with approximately 300 accounts. Hidden Charkha was previously linked to online campaigns against Sikh activists abroad, as reported by the BBC and The Guardian. Khyber Defender, in contrast, has ties to the group Team 64, whose activity is corroborated by content on Facebook and YouTube.
A defining feature of both networks was their extensive use of artificial intelligence. Hidden Charkha employed DALL-E 2 to generate images highlighting India’s economic and defense achievements, while profile photos were created through GAN models, often obscured by veils or architectural angles to avoid detection. Khyber Defender relied on GPT-4o, producing war-themed propaganda with a distinctive stylistic signature. Analysts noted that while AI improved content production and multilingual reach, it simultaneously diminished credibility due to its artificial nature.
The networks also masqueraded as legitimate news outlets. Hidden Charkha launched accounts under names such as Daily Dose News, NewsMasterIndia, and NewsFreak, some posing as fact-checking organizations linked to countermisinformation.com. Khyber Defender pursued aggressive “follow-for-follow” tactics to inflate its audience while coordinating hashtags to trend in Pakistan. Both synchronized their posting schedules: Hidden Charkha typically responded to events within two hours, while Khyber Defender accounts openly acknowledged working “on behalf of” Team 64.
Their campaigns intensified during politically charged moments. Hidden Charkha ramped up activity during the November 2024 anniversary of the Mumbai attacks and farmer protests, while Khyber Defender surged following a Washington Post report on U.S. weapons supplies to militant groups and during coverage of “Operation Goldsmith.”
During military operations, narratives diverged sharply. Hidden Charkha framed “Operation Sindoor” as precise and restrained, underscored by support from international partners. Khyber Defender portrayed “Operation Bunyan-Al-Marsous” as a symbol of Pakistani resolve, highlighting battlefield successes.
Tensions escalated further after India suspended the Indus Waters Treaty. Hidden Charkha depicted the move as a bold act of sovereignty, while Khyber Defender denounced it as a violation of international law, echoed by Al Jazeera.
Both networks actively discredited opposition groups. Hidden Charkha pushed the Hindi hashtag #राहुल_देशद्रोही_है (“Rahul is a traitor to the nation”) targeting opposition leader Rahul Gandhi, while Khyber Defender amplified #PTM_Supports_Terrorism against the Pashtun rights movement.
The cyber domain also became a battlefield for competing narratives. Hidden Charkha claimed to have “hacked over 1,000 cameras” in Pakistan, though no credible evidence supported the claim. Meanwhile, Khyber Defender showcased screenshots of defaced Indian websites and outages, which were reported by The Tribune.
Even after the May 10 ceasefire, both networks remained active. Hidden Charkha asserted that Pakistan had sought mediation due to battlefield failures, while Khyber Defender expressed gratitude toward Donald Trump, pushing hashtags such as #trumpfornobel and #trump_nobel_peace. Both sides sought to project technological superiority, citing falling shares of Chinese defense firms or flaws in foreign aircraft.
Despite the scale of these operations, their overall impact proved limited. Posts rarely extended beyond nationalist echo chambers, and the heavy reliance on AI-generated or falsified content eroded trust. Insikt concludes that these campaigns demonstrate how digital platforms are weaponized to accompany crises, craft favorable narratives, and discredit adversaries.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
