Terror handlers turn to porn apps, Tor-based platforms for secret messaging in J&K

After uncovering the misuse of online gaming platforms by terror groups, security agencies have detected another covert communication tactic involving pornography websites, encrypted applications and Tor-based services, officials said on Sunday, August 30.

According to officials, terror outfits and their handlers in Pakistan's intelligence agency ISI are increasingly exploiting these platforms to communicate with recruits in Jammu and Kashmir while attempting to stay beyond the surveillance mechanisms used to monitor conventional social media.

Some pornography websites have real-time chat features that are ostensibly designed to help users find dates nearby. Officials said terror handlers have been exploiting these tools to send messages and coordinate activities.

Security agencies are also scrutinising several specialised digital platforms, including Tor-based messaging applications such as Coatex and Conion. These services route data through encrypted nodes, making it harder to establish the identity and location of users.

Access to the APK for Conion is reportedly restricted in India. An APK, or Android Package Kit, is the file format used by the Android operating system to distribute and install applications.

Officials said agencies were also monitoring a France-based privacy-focused application that offers end-to-end encrypted messaging without requiring users to provide a SIM card or phone number. Vietnam-based applications and anonymous platforms such as Moonchat are also under scrutiny.

Moonchat has several versions, including PGP-encrypted variants that allegedly bypass conventional registration requirements and are used for finding people nearby.

Some of these pornography applications are banned in India but are allegedly being accessed through VPNs. A virtual private network masks a user's IP address and encrypts internet traffic, making online activity more difficult to trace.

Security experts said platforms operating through the Tor network pose particular challenges for investigators because encrypted traffic is routed through multiple volunteer-operated relay nodes across the world, obscuring its origin and destination.

Tor is maintained by the US-based non-profit The Tor Project and is widely used for legitimate privacy and anti-censorship purposes. However, officials said its anonymity features are increasingly being exploited by clandestine networks, including terror groups.

Security agencies are adapting their cyber-surveillance systems to identify and intercept such "off-grid" communication channels, officials said.

They said terror groups were also exploiting encrypted chat facilities on pornography platforms to recruit and radicalise youths in Jammu and Kashmir.

The shift represents a departure from the use of mainstream platforms such as WhatsApp, Facebook Messenger and Signal. According to officials, handlers are approaching potential recruits through platforms offering varying levels of security, including end-to-end encryption, self-destructing messages and registration without phone numbers or email addresses.

Some applications are designed to function even on slow 2G or EDGE networks, making them potentially useful in areas with limited connectivity.

Officials said the emerging tactics were also being detected against the backdrop of security agencies' efforts to counter the use of foreign-generated virtual SIM cards. Such virtual numbers can be generated by overseas companies and used on smartphones through specialised applications, leaving relatively few digital traces.

The use of such virtual SIMs was highlighted during the investigation into the 2019 Pulwama terror attack, in which 40 CRPF personnel were killed. The National Investigation Agency found during its probe that more than 40 virtual SIM cards had been used by the Jaish-e-Mohammed suicide bomber and his associates in connection with the attack.

Security agencies are now closely tracking the evolving use of encrypted and anonymous digital platforms as terror networks seek new ways to communicate, recruit and coordinate while evading conventional surveillance.