Islamist terrorism in India in 2026 remained contained at the operational level outside Jammu and Kashmir (J&K), but persistent patterns of radicalisation, transnational linkages, and evolving recruitment strategies underline a resilient and adaptive threat. The current trajectory reflects a shift from large-scale coordinated attacks to decentralised modules, lone actors, and digitally facilitated ideological mobilisation, even as security agencies sustain high levels of disruption and interdiction.
On April 22, 2026, a special National Investigation Agency (NIA) court sentenced seven accused, including Lashkar-e-Taiba (LeT) operatives such as ‘mastermind’ T. Naseer, to varying terms of rigorous imprisonment in the 2023 Bengaluru prison radicalisation case, highlighting the persistence of organised radical networks even within correctional institutions.
Earlier, on April 20, 2026, the NIA court in Bengaluru sentenced Arafath Ali to six years rigorous imprisonment in connection with the 2022 Shivamogga Islamic State (IS) terrorism conspiracy case. Investigations revealed his active role in radicalising and recruiting vulnerable youth, as well as instigating inflammatory propaganda activities to incite communal unrest.
On April 17, 2026, the NIA filed a fifth supplementary chargesheet against a suspected IS recruit Areeb Majeed, adding a terrorism funding charge under Section 17 of the Unlawful Activities (Prevention) Act (UAPA), 1967, The charge relates to a USD 1,000 transfer received from a Kuwaiti national while Majeed was in Baghdad in 2014.
On April 13, 2026, the NIA Special Court in Lucknow sentenced three operatives of the Ansar Ghazwat-ul-Hind module linked to Al-Qaeda – Minhaj, Masruddin, and Tauheed – to life imprisonment for plotting serial blasts in Uttar Pradesh around August 15, 2021. Investigations revealed plans involving human bombs and direct instructions from an Al-Qaeda in the Indian Subcontinent (AQIS) handler, Umar Halmandi. This case highlights the continued intent of global jihadist formations to engineer high-impact attacks in India, even as their operational capabilities are frequently neutralised at preparatory stages.
Similarly, on April 9, 2026, the Uttarakhand Special Task Force arrested Vikrant Kashyap for attempting to establish a local module of Tehreek-e-Taliban Hindustan (TTH). Acting under instructions from Pakistan-based handlers linked to the Inter-Services Intelligence (ISI), Kashyap conducted reconnaissance of critical infrastructure in Dehradun and attempted to generate symbolic terror through graffiti and surveillance activities. The case is significant for illustrating the increasing reliance on radicalised individuals tasked with low-cost, high-visibility operations, as well as the continued role of Pakistani handlers in facilitating recruitment, reconnaissance, and escape logistics.
Despite the disruption of plots, isolated incidents of violence persist. The November 10, 2025, bomb explosion near the Red Fort in Delhi, which resulted in multiple civilian fatalities and injuries, underscored vulnerabilities in urban environments. Although no outfit claimed responsibility, the incident triggered extensive forensic and intelligence investigations, including analysis of communication data and surveillance of digital activity. In another major recovery on the same day, security agencies seized 300 kilograms of RDX and weapons in Haryana following the arrest of a Jaish-e-Mohammed (JEM) operative, indicating the scale of potential attacks being planned and the importance of pre-emptive intelligence.
A notable trend is the growing convergence of transnational jihadist organisations and their adaptation to India’s security environment. Intelligence reports indicate that outfits such as AQIS and Islamic State Khorasan Province (ISKP) are coordinating their operational spheres, with AQIS focusing on northern and northeastern regions and ISKP on the southern region of India. This strategic division, reportedly facilitated by the ISI, reflects an attempt to maximise impact while avoiding operational overlap. Concurrently, Bangladesh-based groups such as Harkat-ul-Jihad Islami (HuJI) and Jama’atul Mujahideen Bangladesh (JMB) are increasingly operating through proxy identities and local modules to evade detection and maintain deniability.
The role of Bangladesh as a staging ground for anti-India activities has become more pronounced. Intelligence inputs suggest that radical leaders based in Bangladesh are targeting India’s eastern and northeastern regions for infiltration and recruitment. The use of illegal migration networks, particularly through West Bengal and the Northeast, continues to facilitate the movement of operatives and the establishment of sleeper cells. The NIA’s November 2025 raids across multiple states in the Al-Qaeda Gujarat conspiracy case, involving illegal Bangladeshi immigrants, further underline the transborder dimension of the threat.
Another significant shift is the increasing emphasis on digital radicalisation and “white-collar” recruitment. The December 2025 arrest of a software professional in Pune linked to Al-Qaeda networks revealed extensive use of encrypted platforms, foreign IP routing, and online propaganda dissemination. Investigations uncovered over 100 digital channels used for ideological indoctrination and communication with handlers. This trend indicates a long-term strategy focused on building ideological ecosystems rather than immediate operational execution, complicating detection and intervention.
The banned Popular Front of India (PFI) and its affiliates continue to constitute a latent threat, despite sustained crackdowns. Investigations presented before courts in December 2025 indicated efforts by PFI operatives to procure arms from neighbouring countries and send cadres abroad for training with the IS. Financial networks linked to PFI and its political wing, the Social Democratic Party of India (SDPI), have been exposed for channelling funds through hawala routes, fake trusts and overseas donations, to support radicalisation and violence. The persistence of such networks demonstrates the challenges of dismantling entrenched organisational structures even after formal bans.
Hizb-ut-Tahrir (HuT), another transnational organisation, has expanded its footprint in India through religious gatherings and targeted recruitment drives. Investigations suggest that HuT leaders based in Bangladesh are orchestrating recruitment campaigns in multiple Indian states, leveraging ideological narratives and community networks. The group’s focus on establishing a pan-Islamic Caliphate, and its use of covert mobilisation tactics make it a significant long-term concern.
Data trends further reinforce the pattern of containment alongside persistent activity. According to SATP data on Islamist terrorism (outside J&K), 82 terrorists have already been arrested in 42 incidents in 2026, compared to 147 arrests in 100 incidents in 2025, and 114 arrests in 58 incidents in 2024. While the decline in incidents suggests improved preventive capabilities, the steady number of arrests indicates ongoing attempts at mobilisation and recruitment. Since 2000, a total of 4,210 terrorists have been arrested in 1,784 incidents, reflecting sustained operational pressure by security agencies.
Incidents of explosion remain limited but noteworthy. In 2026, two such incidents were recorded without fatalities, compared to three incidents in 2025, with 12 fatalities (10 civilians, one militant and one NS). There were four such incidents, without fatalities, in 2024. Since 2000, 195 explosions linked to Islamist terrorism outside J&K, have resulted in 1,165 fatalities [967 civilians, 92 SFs, 48 militants and 58 in the Not Specified (NS) category]. The relatively low frequency of such incidents in recent years indicates effective disruption, but the recovery of large quantities of explosives in multiple cases suggests that the threat of high-casualty attacks persists.
The performance of NIA and other security agencies has been a critical factor in containing Islamist terrorism. With a conviction rate exceeding 92 per cent and extensive use of asset attachment, digital forensics, and inter-agency coordination, NIA has significantly degraded operational networks. In 2025 alone, the agency registered 55 cases relating to Islamist terrorism outside J&K, arrested 276 accused across categories, and secured 66 convictions. Continuous monitoring of online spaces, financial flows, and cross-border linkages has further strengthened preventive capabilities.
However, the evolving nature of the threat presents new challenges. The increasing use of encrypted communication, decentralised cells, and self-radicalised individuals reduces the effectiveness of traditional intelligence methods. The strategic shift by global jihadist organisations towards long-term ideological influence, combined with the exploitation of local grievances and identity politics, creates a complex security environment.
Moreover, the involvement of external state and non-state actors, particularly through the ISI’s facilitation of coordination among jihadist groups, underscores the geopolitical dimension of the threat. The use of neighbouring countries as safe havens and transit routes complicates counter-terrorism efforts and necessitates enhanced regional cooperation.
The circulation of Fake Indian Currency Notes (FICN) remains a significant component of the broader Islamist terrorism-financing ecosystem in India, with clear cross-border linkages. Intelligence inputs on December 10, 2025, indicated a sharp resurgence in FICN activity, with Pakistan’s ISI and the Dawood Ibrahim syndicate (D-Syndicate) playing a key role. High-quality counterfeit notes, reportedly printed in Pakistan, are primarily routed into India via Bangladesh, with West Bengal’s Malda and Murshidabad Districts emerging as major hubs. A secondary route through the United Arab Emirates into Kerala points to increasing diversification and resilience of smuggling networks.
The Reserve Bank of India (RBI), in its Annual Report for 2024-25, released on June 14, 2025, reported a marginal overall decline in FICN detections, but a sharp increase in counterfeit INR 200 and INR 500 notes by 13.9 per cent and 37.3 per cent, respectively. The INR 500 denomination remains the most counterfeited, while fake INR 2,000 notes have sharply declined following their withdrawal from circulation.
Meanwhile, official data presented in Parliament on August 11, 2025, recorded INR 2,17,000 in fake notes recovered in 2024-25, compared to INR 2,23,000 in 2023-24. Among the seizures, INR 500 denomination notes (MG New Series) accounted for the largest share at 1,17,722 pieces, followed by 51,069 counterfeit INR 100 notes and 32,660 fake INR 200 notes.
Investigations by NIA underline the nexus between FICN and terrorist financing. On February 6, 2026, NIA charge-sheeted an accused linked to Pakistan-Nepal smuggling networks, while on January 19, 2026, charges were framed against three accused circulating counterfeit notes under instructions from a Pakistan-based handler. These cases highlight the continued use of FICN as a low-cost, deniable instrument to finance extremist activities in India.
The current Islamist terrorism landscape in India reflects effective operational containment but persistent structural vulnerabilities. Security agencies, particularly NIA, have disrupted networks and maintained high conviction rates, yet decentralised cells, online radicalisation, and transnational linkages sustain a residual threat. The growing role of encrypted platforms, cross-border facilitation by entities like ISI and its proxies, and diversified financing channels, including FICN, underscore evolving challenges. While large-scale attacks remain rare, the continued recovery of explosives, active recruitment, and ideological expansion indicate a resilient ecosystem requiring sustained, adaptive counter-terrorism responses to neutralise the persistent and adaptive threat of Islamist extremism in India.
