AHMEDABAD: A 53-year-old man, who came to Gujarat from Pakistan and was given Indian citizenship in 2005, was arrested by the Gujarat anti-terror squad (ATS) on charges of helping Pakistani authorities spy on Indian defence personnel, a senior police officer said on Friday.

ATS superintendent of police Om Prakash Jat said Labhshankar Maheshwari, who was living in Tarapur town of Anand district, has been arrested on accusations that he circulated malware through WhatsApp among defence personnel, which was used by Pakistani intelligence agencies to get information from their phones.

At one point, Maheshwari posed as an employee of an army school and persuaded parents to download a file that he claimed was necessary to record some information. At one point, he also convinced many army personnel to install the application by falsely linking it to the government’s ‘Har Ghar Tiranga’ campaign, said Jat. He also sent out messages that encouraged recipients to install the app and upload a photo of their child with the national flag.

The ‘apk’ file was a Remote Access Trojan (RAT), a malicious software designed to extract data from mobile phones. This data could include sensitive information such as contacts, location information and videos, according to Gujarat ATS.

The stolen data was sent to a data centre accessed by the Pakistan army including the Inter-Services Intelligence (ISI) for processing, he added.

“It has been confirmed that the mobile phone of a soldier stationed in Kargil was compromised with this malware,” said Jat.

Maheshwari has been charged under sections 123 (concealing design to wage war against the government) and 121-A (conspiracy to wage war against the government) of the Indian Penal Code. He also faces charges under relevant sections of the Information Technology Act.

“Our investigation has shown that Maheshwari, who originally hails from Pakistan and was granted Indian citizenship in 2005, agreed to participate in this conspiracy to expedite the visa process for himself, his wife, and two other family members who wished to visit Pakistan to meet their relatives,” said Jat.

The action was taken following information received from the military intelligence which had identified an Indian phone number being used to circulate malware to spy for Pakistan. This information led the investigators to Maheshwari who owned a grocery shop in Anand.

Citing Maheshwari’s interrogation, officials said he allegedly came in contact with Pakistani intelligence when he was looking to visit Pakistan and on the advice of a relative, got in touch with an unidentified person for the visas. Maheshwari was in touch with this individual after his return to facilitate visa applications of his other relatives including his sister and niece.

He subsequently came in touch with two individuals identified as Saqlain Thaim of Jamnagar and Asgar Modi, who got him to spread the malware among defence personnel for espionage

Both Thaim and Modi are currently on the run and are believed to have left the country. “One is reportedly in Somalia, while the other is in Dubai,” according to a Gujarat ATS official