On 22 April 2025, a terrorist attack in Pahalgam, Jammu & Kashmir, killed 26 people. The four attackers questioned each person’s religion and shot those whom they identified as Hindu, according to survivor accounts cited by the AP News. Given the historical volatility and nuclear capabilities of India and Pakistan, the probability of further escalation following the Pahalgam attack remains non-trivial. This Insight examines how the Pahalgam attack was framed online, identifies dominant post-attack extremist narratives and mobilisation, and offers targeted mitigation measures.
Background and Context
The Resistance Front (TRF) claimed the attack on Telegram, per Al Jazeera. The South Asia Terrorism Portal classifies TRF as a proxy of Lashkar-e-Taiba (LeT). Viewing India’s subsequent move on 23 April to suspend the 1960 Indus Waters Treaty, as an ‘act of war’, the Pakistan government responded on 24 April by suspending the 1972 Simla Agreement. Both these agreements lock the two countries into legal frameworks for conflict resolution. On 26 April, TRF withdrew its claim of responsibility, stating that the original message was the result of a cyber intrusion. On 7 May, India launched Operation Sindoor, a cross-border military campaign involving airstrikes across the border. Following the attack, the Indian Defence Minister stated that the terrorists who killed 26 people in Indian-administered Kashmir last month “erasing the sindoor (the red vermilion worn by married Hindu women) of many families”, had now been brought to justice. Between 7 and 10 May, both nations conducted reciprocal airstrikes. Both India and Pakistan are nuclear-armed; India declares ‘no first use,’ Pakistan does not. On 10 May 2025, India and Pakistan agreed to a full ceasefire.
Methodology & Limitations
Online discourse on the Pahalgam attack and its aftermath (22 April – 1 June 2025) was examined through 866 Reddit posts collected with the Python Reddit API Wrapper. The script searched Reddit for up to 200 posts per keyword across Hindi, Urdu, Malayalam, Bengali, Gujarati, Tamil, and English, sorted by relevance, and captured metadata on each post and its author. Reddit’s pseudonymous environment and niche subreddits make it a rich data source for observing the early stages of radicalisation, where users might feel more comfortable expressing nascent extreme views or engaging with radicalising content. Studies have shown how memes, news stories, and fringe ideas can incubate and gain momentum on Reddit before appearing on more mainstream media.
To enhance the efficiency of thematic categorisation for the 866 Reddit posts, initial labelling was conducted using Gemini 2.0. This model was used to process the raw text of each post and suggest preliminary thematic categories based on the content. Following this automated step, all AI-generated labels were then comprehensively reviewed, verified, and, where necessary, adjusted by a human analyst. Due to single-analyst coding, the dataset lacks intercoder validation, and relative theme weight may be distorted by post volume rather than engagement intensity.
Findings
Among the 866 analysed Reddit posts, 78% were neutral discussions that mainly shared news links and press releases. The remainder consisted of victimhood (10%), justification of violence (1%), calls to action (8%) and content with conspiratorial framing (3%). Notably, the preliminary AI labels were frequently inaccurate in cases where Reddit posts contained code-switched content or multiple languages, particularly when Kashmiri or Urdu were present alongside English or Hindi.
The interaction between victimhood, justification, and calls to action creates a potent radicalisation vector. When these narratives exist in an information environment, along with conspiratorial content, this process can lead to alternate versions of reality where governments, media, or entire groups are seen as secretly responsible for the harm. According to the Radicalization Awareness Network (2021), these theories make people see violence as the only solution in the long term. This dynamic is central to understanding why early narrative detection is critical to preventing radicalisation and real-world escalation.
Victimhood
Among the 866 analysed Reddit posts, victimhood narratives accounted for 10%. The table below highlights key themes within this category, and their broader relevance in shaping online perceptions and potential radicalisation pathways.
| Theme | Narrative Function |
| Content questioning why prominent public figures, celebrities, and international activists were largely silent on the Pahalgam killings, while vocal in condemning violence in Gaza. | This theme suggested a double standard in global empathy, framing Hindus as overlooked victims of religiously motivated violence. By presenting Hindus as victims of global indifference, violent extremists can mobilise support for aggressive actions in the name of self-preservation. When NGOs, celebrities, or the media are accused of bias, it delegitimises their credibility, opening space for alternative, radical voices to dominate discourse. This narrative reinforced identity consolidation and calls for collective defence, invoking historical grievances and patterns of targeted violence. The idea that “all Hindus are under attack” is a recruitment hook, especially among youth seeking belonging, purpose, or moral clarity. |
| AI-generated recreations of the attack circulated, depicting dramatised versions of the events in engaging visual formats, including cartoons. | Set to music, recreations of the attack using cartoon figures enable sophisticated narrative shaping, especially in minority Indian languages such as Gujarati. These formats often evade moderation while maintaining high dissemination potential. |
Figure 1: Still from an animated video recreating the Pahalgam attack, depicting armed militants confronting a civilian.
Justification of Violence
Among the 866 analysed Reddit posts, justification of violence narratives accounted for 1%. The table below outlines the most prominent justification themes observed and the relevance of each narrative.
| Theme | Narrative Function |
| The attack was framed as religious revenge for the construction of the Ram Mandir. | The temple’s construction is portrayed as a humiliation of Muslim identity and history, particularly because it replaced the Babri Masjid, thus framing the attack as moral and religious retribution. |
| The attack was justified as retaliation for a Baloch Liberation Army train hijacking on 12 March, during which militants hijacked a train, checked passengers’ identities, and executed those who were not ethnically Baloch, including Pakistani soldiers, per BBC reports. | The similarity in method of attack, such as executing individuals after identifying their ethnic/ religious identity, is positioned as a parallel to the Pahalgam attack. The narrative accuses India of supporting separatist terrorism in Pakistan, which is then used to portray the Pahalgam attack not as terrorism, but as a countermeasure. |
| TRF-linked narratives positioned the attack as a response to increased tourism in Kashmir. | Tourism promotion is key to India’s attempt to normalise control over disputed territories in Jammu & Kashmir. By framing the attack as a response to state-led tourism development, this narrative reinforces separatist messaging and weakens support for the Indian state and potentially pushes local youth toward radical networks by harming the local economy reliant on tourism. |
| Some narratives claimed that Islam mandates violence against non-believers, as a religious duty rooted in theology. These are accompanied by archival footage of fighters walking through the streets of Kashmir. | Depicting violence against non-believers as a religious obligation, then glorifying past militancy with archival footage, channels users toward deeper ideological grooming. Framed as cultural commentary, each element alone skirts platform rules, letting the composite evade moderation. |
Figure 2: Reddit post framing the Pahalgam attack as mirroring an earlier Baloch Liberation Army attack on Pakistani soldiers.
Figure 3: Reddit post sharing archival footage of armed Kashmiri militants, framed as “resistance fighters” who once operated openly. While the post states that the current ideology favors an independent Kashmir without merging with any country, it references past militancy.
Calls to Action
Among the 866 analysed Reddit posts, calls to action narratives accounted for 8%. The table below outlines the dominant calls to action observed on Reddit, and their broader socio-political significance.
| Theme | Narrative Function |
| There were calls for the explicit dehumanisation of Muslims, with demands for exclusion from public life, services, and, in extreme cases, physical violence. | By portraying Muslims as inherently hostile, this narrative aligns with ethno-religious incitement strategies that normalise communal violence. |
| There were calls of support for the involvement of Baloch Liberation Army (BLA) as a strategic partner in retaliating against Pakistan. | This discourse supports insurgent legitimisation and frames non-state actors as legitimate allies in state conflict. It echoes proxy war logic, commonly observed in online ecosystems sympathetic to secessionist movements. |
| There were widespread demands for a forceful military response by India, as a necessary act of proportional justice. | This reflects militarised nationalist discourse, where public sentiment is mobilised to legitimise preemptive or retaliatory violence |
| There was advocacy for the denial of medical care to Muslim patients as collective punishment for the attack. Additionally, calls for the collective targeting of Kashmiri civilians as complicit in the attack, accompanied by calls for surveillance and exclusion, were also observed. | This marks a form of extremism, where essential services are leveraged as tools of punitive exclusion. |
| Another theme was coordinated harassment efforts in vilification of victims’ families who called for restraint, portraying them as disloyal or manipulated. Himanshi Narwal, widow of Indian Navy Lieutenant Vinay Narwal, who was off duty when he was killed during the attack, became a prominent target of online extremist backlash, following her public appeal for peace and her explicit call to refrain from targeting Muslims or Kashmiris in response to the violence. | This illustrates how grief is ideologically instrumentalised in extremist spaces to enforce conformity and suppress moderation. |
Figure 4: Reddit post invoking religious justification for retaliatory violence following the Pahalgam attack, citing a monastic speaker and Hindu scriptures.
Figure 5: Reddit post amplifying a statement attributed to the Baloch Liberation Army (BLA), and offering military support to India in the event of an offensive against Pakistan. The BLA is designated as a terrorist organisation in the US and proscribed in the UK.
Conspiratorial Framing
Among the 866 analysed Reddit posts, conspiratorial narratives accounted for 3%. The following table presents the most salient conspiratorial narratives identified and their broader contextual significance.
| Theme | Narrative Function |
| It was claimed that Indian security forces had prior intelligence about the planned attack but chose not to act. | According to this narrative, the attack was permitted to occur in order to justify a military escalation against Pakistan. This narrative framing portrays the Indian state as willing to sacrifice its own civilians for strategic gain. |
| It was argued that the Pahalgam attack was staged or entirely fabricated by Indian agencies. Misleading videos alleging that the victims were actors, or showing them dancing and alive, suggesting they had not been killed, often accompanied the claim. | Suggesting that victims are actors or by branding the attack a false flag, extremists can delegitimise the state’s and media ecosystems’ credibility, presenting themselves as the only “truth-tellers”, a recruitment tactic used to build in-group loyalty and out-group hostility. |
| A leaked document, dated 29 April 2025, and allegedly originating from Indian Military Intelligence, advised against deploying Sikh soldiers in sensitive operations due to perceived loyalty concerns. | Media outlets exposed the document as a forgery intended to widen perceived Sikh–Army rifts and revive Khalistani narratives of Sikh marginalisation. Khalistani factions have historically used Sikh marginalisation to advance secessionist agendas. Pakistan-based hackers also reportedly defaced Indian websites and breached defence networks, reinforcing a coordinated information-warfare campaign amid the crisis, per the Times of India. |
| A more geopolitically oriented conspiracy linked the timing of the attack to the visit of U.S. Vice President J.D Vance to South Asia. | It frames the U.S. as a power manipulating South Asia and reinforces the idea that local violence is externally engineered. This deflection allows militant groups to avoid moral condemnation by redirecting public anger toward foreign actors. |
Figure 6: Reddit post promoting a narrative linking the Pahalgam attack to the visit of the U.S. Vice President J.D. Vance.
Recommendations
- As previously observed during unrest in Bangladesh, to effectively assess the risk of further escalation of violence in the South Asia region, it is essential to enhance local expertise in global tech platforms, whether through in-house development through targeted recruitment of regional language moderators, integration of ethnolinguistic threat taxonomies, and adaptive regional escalation protocols or collaboration with third parties. There is an immediate need for locally focused early risk indicators focused on Kashmiri, Pashto, Dogri, and Urdu.
- Technology platforms, such as Reddit, must consider that narratives surrounding the Pahalgam attack are increasingly transnational in nature, circulating across diasporas in North America, Europe, and the Gulf. Platforms must track and mitigate the cross-border diffusion of Pahalgam-related extremist narratives within South Asian diaspora communities, as these narratives can create intercommunal polarisation, targeted harassment, and the diffusion of extremist recruitment in diaspora settings.
- Additionally, content that may fall within permissible bounds under South Asian content governance frameworks may constitute violations under more stringent counter-extremism laws in other regions. Platforms must implement jurisdiction-sensitive enforcement strategies supported by cross-border narrative monitoring. This requires integrating content detection and insight pipelines across hate speech, misinformation, and violent extremism, with specific escalation criteria for multilingual, diasporic, and crisis-related content flows.
—
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.