Recycled videos, fake death claims and 'Bharat Bytes': How a Pakistan-origin network tried to exploit Delhi protests

Market Mastery

Webinar by Vishal Malkan

Find the weak links

in your portfolio by Vishal Malkan

A cross-border digital operation originating in Pakistan allegedly sought to exploit the October 10 demonstrations in New Delhi, using fake media identities and a coordinated network of automated accounts to spread fabricated claims about police violence, mass casualties and military intervention. According to an exclusive investigation by CNN-News18, Indian intelligence agencies and Delhi Police confirmed findings pointing to a sophisticated campaign aimed at manipulating public perception and inflaming domestic divisions.

At the centre of the operation was a pseudo-media entity called Bharat Bytes, reportedly backed by thousands of deceptive social media accounts designed to appear Indian. The campaign allegedly used recycled footage, fabricated reports and coordinated online amplification to create a false picture of state repression, while pushing divisive narratives into regional digital communities.

Fake Indian identities, Pakistan-origin network: How the operation worked

According to CNN-News18, the operation relied on a network of proxy accounts that used Indian names, stolen regional profile pictures and carefully crafted biographies to pose as political volunteers, student representatives and grassroots activists.

The accounts reportedly operated in Hindi, English and regional languages to establish credibility among Indian social media users. By disguising their foreign origins, the operators sought to make fabricated claims appear to be eyewitness accounts from protest locations.

The network allegedly followed a coordinated amplification strategy. Once a primary account published a misleading claim or manipulated video, hundreds of linked accounts reposted and engaged with the content within seconds. The same material was then circulated through private WhatsApp and Telegram channels, with the aim of increasing its reach and influencing trending algorithms.

CNN-News18 reported that intelligence assessments identified efforts to direct these narratives towards regions including southern India, Punjab and Jammu and Kashmir, with the stated objective of provoking regional tensions and widening domestic divisions.

Fake death toll claims, recycled protest footage

One of the most prominent examples involved claims that Delhi Police had opened fire on demonstrators on October 10, allegedly killing 13 people and injuring 33 others.

According to the findings cited by CNN-News18, fact-checking units identified the accompanying footage as old material from February 2024. The visuals reportedly showed security forces using tear gas against protesting farmers near the Shambhu border between Punjab and Haryana, rather than police firing on demonstrators in Delhi.

The circulation of old footage alongside fabricated casualty figures was part of the alleged effort to portray the protests as a scene of deadly state violence.

Another claim circulated by the network alleged that law enforcement personnel opened fire during an opposition march towards the Supreme Court and injured Congress MP Rahul Gandhi.

CNN-News18 reported that cyber forensic investigators traced the account identified as @indiantiwari01 to registration and initial posting activity in Lahore, Pakistan. The post was allegedly amplified by secondary accounts operating through neighbouring regional IP clusters.

The claims were presented as real-time updates, despite investigators identifying them as part of a coordinated disinformation operation.

False claims of Army deployment in Delhi

The alleged campaign also sought to create alarm by circulating claims that the Indian Army had entered New Delhi to impose military control over civilian protesters.

According to the account detailed by CNN-News18, these posts were distributed alongside altered audio and video clips to suggest that the situation in the capital had spiralled beyond the control of civilian authorities.

The fabricated reports sought to portray an escalating breakdown of law and order, while reinforcing claims of excessive state force. The alleged use of manipulated media, false casualty figures and invented military developments points to the range of narratives the network was attempting to push into public discourse.

Delhi Police, cyber units move to disrupt network

Following the verification of the suspected operation, cybercrime divisions and specialised law enforcement units initiated takedown requests to social media platforms to disrupt the network's digital infrastructure, according to the report.

Authorities have also registered multiple First Information Reports (FIRs) under provisions relating to cybersecurity, criminal conspiracy and public mischief, CNN-News18 reported.

Investigators are continuing to monitor online activity linked to the suspected network. Authorities have advised the public to verify breaking news against credible sources and official statements before sharing unverified videos, casualty figures or claims of military deployment.

The operation, as described by CNN-News18, highlights how fabricated media identities, automated amplification and recycled footage were allegedly used to exploit domestic protests and attempt to deepen political and regional polarisation in India.