Plan recognition is the problem of inferring an agent's hidden state of plans, or intentions, based on the pattern of his observable actions. Among many potential applications, intention recognition can be particularly useful for intelligence analysis and homeland security related problems. While most of the existing work in plan recognition has focused on studying overt agents, problems from the intelligence domain usually have different settings, where hostile agents operate covertly in a large population of otherwise benign entities. In this paper we formulate a problem of detecting and tracking hostile intentions in such an environment - a virtual world where a large number of agents are involved in individual and collective activities. Most of the agents are benign, while a small number of them have malicious intent. We describe our initial effort for building a probabilistic framework for detecting hostile activities in this system, and provide some initial results for simple scenarios.