Pakistan’s NCCIA rescued a 13-year-old girl in Karachi after a dark web group recruited her through social media, moved her onto a messaging application, and began assigning her harmful tasks, including harming a pet, escalating toward self-harm. The NCCIA intervened after receiving intelligence from a foreign agency, traced the girl’s IP address, and provided her with psychological counselling. An investigation is ongoing to identify other victims and those responsible.
How the Group Recruited Her
The details of how this group operated are important for parents to understand, because the starting point was not the dark web. It was social media.
According to Nawaz, the girl was first exposed to the group through a mainstream social media platform. From there, she was moved onto a messaging application, where actual communication and task assignment took place. The dark web itself was where the group appears to have been organised and operated, but the recruitment funnel started somewhere most teenagers use every day.
This is a consistent pattern with similar operations that have emerged globally. These groups don’t announce themselves as dangerous on their first contact. They build a relationship over time, gradually involving a young person more deeply before introducing escalating instructions.
The tasks the girl was assigned followed a progression. The NCCIA confirmed that one task involved harming a pet animal. The next task, which she had not yet completed when investigators located her, was to cause self-harm. In this type of operation, the tasks typically grow more serious over time, and the group uses the completion of earlier tasks as a form of psychological hold, the young person has already done things they feel they cannot tell their family about, which makes them more compliant with what comes next.
This pattern is similar to the Blue Whale Challenge phenomenon that has been documented in multiple countries since the mid-2010s, in which teenagers were assigned a series of increasingly dangerous daily tasks by online operators, ultimately resulting in deaths. The NCCIA has not confirmed whether this specific group is connected to any previously known operation, but the structure of what is described bears the same hallmarks.
The Warning Signs Her Parents Missed
None of this means the girl’s parents were negligent. Nawaz noted that when they were interviewed by the NCCIA, they described exactly the kind of behavioural shift that these operations rely on families not immediately connecting to online activity.
She had become withdrawn and upset. She didn’t share what was troubling her when they asked. Behavioural changes, emotional withdrawal, and secrecy about online activity are the most visible signs that something is wrong but they’re also common in teenagers generally, which is why parents often don’t immediately connect them to a specific online threat.
The NCCIA has now provided the girl with psychological counselling to help her process what happened. Her devices have been seized for forensic analysis as part of the ongoing investigation.
A Pattern of International Cooperation
What’s striking about this case is that Pakistan didn’t catch this through its own domestic monitoring. A foreign crime investigation agency sent intelligence to the NCCIA, including contact via email. The NCCIA then used that tip to trace the IP address and locate the girl.
This mirrors how the NCCIA’s other notable recent case also began. In September 2026, the agency arrested a teenager who had allegedly used AI chatbots and online platforms to research how to poison his father, a case that was also triggered by a tip-off from the FBI in the United States. That boy had procured chemicals from Australia and Islamabad after being influenced by an OTT crime series.
Taken together, these two cases show both the growing international nature of cybercrime involving teenagers and the dependence of Pakistan’s NCCIA on foreign intelligence agencies to identify domestic cases. The NCCIA is working to establish whether there are additional victims of the same dark web group and to identify those responsible for running it.
The international dimension of online child safety isn’t unique to Pakistan. As we covered in Operation Alice, the Europol operation that shut down 373,000 dark web sites and identified hundreds of customers of those platforms, cross-border cooperation is essential in any law enforcement action involving the dark web. These networks don’t respect national borders, and neither do the children they target.
Why the Dark Web Makes This Harder to Detect
Understanding why these groups use the dark web matters for understanding the challenge authorities face.
The dark web, accessible only through software like Tor and intentionally hidden from standard search engines provides anonymity for its operators. The group behind the Karachi case was operating there, which means finding the administrators is significantly harder than locating a criminal enterprise operating on a normal website or social media platform. They could not be found by simply searching for them online, and their communications were designed to avoid leaving easily traceable records.
This is not the first time Pakistan has seen children pulled toward harmful online communities. What is new is the specific use of dark web infrastructure to organise these operations while using mainstream social media as a recruitment channel, a combination designed to stay hidden from parents and authorities for as long as possible. Our guide on the dark web and how it differs from the deep web covers the basics of how that anonymity layer works.
What Parents Should Watch For
The NCCIA has not provided detailed public guidance specific to this case, but the facts that emerged suggest several warning signs worth watching for.
A sudden and sustained change in a child’s mood or behaviour particularly lasting weeks or months, especially if it coincides with increased time on their devices and unwillingness to discuss what they are doing online. A shift from open online activity to private messaging apps, particularly ones parents aren’t familiar with or don’t have visibility into. A reluctance to show parents the screen or a habit of putting the device away when an adult approaches.
None of these signs are conclusive on their own. But the pattern of exposure, social media first, messaging app next, means that monitoring social media alone is not sufficient. The messaging layer is where the actual harmful communication is happening.
Reporting and Getting Help in Pakistan
Pakistan’s NCCIA operates a helpline for cybercrime reporting. Reports can also be submitted online through the FIA’s Cyber Crime Reporting System. The NCCIA can be reached through the Pakistan Telecommunication Authority at pta.gov.pk or by contacting local police alongside the agency.
If a child discloses something concerning about their online activity, the correct response is not punishment or confiscating devices immediately , doing so can cause a child to shut down and stop sharing. Listening without immediate judgment, and then seeking professional guidance and, if necessary, contacting authorities, is the recommended path.
Childline Pakistan operates a helpline for children in distress. UNICEF Pakistan has published online safety guidance for parents and educators, and local mental health support is available through hospitals and psychologists if a child has been exposed to a harmful online group.
Frequently Asked Questions
What is the NCCIA?
Pakistan’s National Cyber Crime Investigation Agency, responsible for investigating cybercrime, including cases involving online threats to children.
How did the NCCIA find the girl?
They received a tip-off from an unnamed foreign crime investigation agency. That agency also shared an email, which the NCCIA used alongside IP address tracking to locate the girl.
What tasks was the girl being assigned?
The NCCIA confirmed she was assigned to harm a pet animal. The next pending task, which she had not yet completed, was to harm herself.
Has anyone been arrested in this case?
No arrests have been announced. The investigation is ongoing and focused on identifying other potential victims and the people running the group.
What should parents do if they suspect their child is involved in something like this?
Stay calm, listen without immediate punishment, and contact the NCCIA or local authorities. Seek psychological support for the child if they have been exposed to harmful instructions online.
