US, European, and Japanese authorities, along with tech companies including Microsoft and Cloudflare, say they’ve disrupted Lumma, an infostealer popular with criminal gangs.

A consortium of global law enforcement agencies and tech companies announced on Wednesday that they have disrupted the infostealer malware known as Lumma. One of the most popular infostealers worldwide, Lumma has been used by hundreds of what Microsoft calls “cyber threat actors” to steal passwords, credit card and banking information, and cryptocurrency wallet details. The tool, which officials say was developed in Russia, has provided cybercriminals with the information and credentials they needed to drain bank accounts, disrupt services, and carry out data extortion attacks against schools, among other things.

Microsoft’s Digital Crimes Unit (DCU) obtained an order from a United States district court last week to seize and take down about 2,300 domains underpinning Lumma’s infrastructure. At the same time, the US Department of Justice seized Lumma’s command-and-control infrastructure and disrupted cybercriminal marketplaces that sold the Lumma malware. All of this was coordinated, too, with disruption of regional Lumma infrastructure by Europol’s European Cybercrime Center and Japan’s Cybercrime Control Center.

Microsoft lawyers wrote on Wednesday that Lumma, which is also known as LummaC2, has spread so broadly because it is “easy to distribute, difficult to detect, and can be programmed to bypass certain security defenses.” Steven Masada, assistant general counsel at Microsoft’s DCU, says in a blog post that Lumma is a “go-to tool,” including for the notorious Scattered Spider cybercriminal gang. Attackers distribute the malware using targeted phishing attacks that typically impersonate established companies and services, like Microsoft itself, to trick victims.

“In 2025, probably following Redline’s disruption and Lumma’s own development, it has ranked as the most active module, indicating its growing popularity and widespread adoption among cybercriminals,” says Victoria Kivilevich, director of threat research at security firm Kela.

Microsoft says that more than 394,000 Windows computers were infected with the Lumma malware between March 16 and May 16 this year. And Lumma was mentioned in more than 21,000 listings on cybercrime forums in the spring of 2024, according to figures cited in a notice published today by the Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA). The malware has been spotted bundled in fake AI video generators and fake “deepfake” generation websites, and distributed by fake captcha pages.

Law enforcement’s collaboration with Microsoft’s DCU and other tech companies like Cloudflare focused on disrupting Lumma’s infrastructure in multiple ways, so its developers could not simply hire new providers or create parallel systems to rebuild.

“Cloudflare’s role in the disruption included blocking the command-and-control server domains, Lumma’s Marketplace domains, and banning the accounts that were used to configure the domains,” the company wrote in a blog post on Wednesday. “Microsoft coordinated the takedown of Lumma’s domains with multiple relevant registries in order to ensure that the criminals could not simply change the name servers and recover their control.”

While infostealing malware has been around for years, its use by cybercriminals and nation-state hackers has surged since 2020. Typically, infostealers find their way onto people’s computers through downloads of pirated software or through targeted phishing attacks that impersonate established companies and services, like Microsoft itself, to trick victims. Once on a computer it is able to grab sensitive information—such as usernames and passwords, financial information, browser extensions, multifactor authentication details, and more—and send it back to the malware’s operators.

Some infostealer operators bundle and sell this stolen data. But increasingly the compromised details have acted as a gateway for hackers to launch further attacks, providing them with the details needed to access online accounts and the networks of multibillion-dollar corporations.

“It’s clear that infostealers have become more than just grab-and-go malware,” says Patrick Wardle, CEO of the Apple device-focused security firm DoubleYou. “In many campaigns they really act as the first stage, collecting credentials, access tokens, and other foothold-enabling data, which is then used to launch more traditional, high-impact attacks such as lateral movement, espionage, or ransomware.”

The Lumma infostealer first emerged on Russian-language cybercrime forums in 2022, according to the FBI and CISA. Since then its developers have upgraded its capabilities and released multiple different versions of the software.

Since 2023, for example, they have been working to integrate AI into the malware platform, according to findings from the security firm Trellix. Attackers want to add these capabilities to automate some of the work involved in cleaning up the massive amounts of raw data collected by infostealers, including identifying and separating “bot” accounts that are less valuable for most attackers.

One administrator of Lumma told 404Media and WIRED last year that they encouraged both seasoned hackers and new cybercriminals to use their software. “This brings us good income,” the administrator said, referring to the resale of stolen login data.

Microsoft says that the main developer behind Lumma goes by the online handle “Shamel” and is based in Russia.

“Shamel markets different tiers of service for Lumma via Telegram and other Russian-language chat forums,” Microsoft’s Masada wrote on Wednesday. “Depending on what service a cybercriminal purchases, they can create their own versions of the malware, add tools to conceal and distribute it, and track stolen information through an online portal.”

Kela’s Kivilevich says that in the days leading up to the takedown, some cybercriminals started to complain on forums that there had been problems with Lumma. They even speculated that the malware platform had been targeted in a law enforcement operation.

“Based on what we see, there is a wide range of cybercriminals admitting they are using Lumma, such as actors involved in credit card fraud, initial access sales, cryptocurrency theft, and more,” Kivilevich says.

Among other tools, the Scattered Spider hacking group—which has attacked Caesars Entertainment, MGM Resorts International, and other victims—has been spotted using the Lumma stealer. Meanwhile, according to a report from TechCrunch, the Lumma malware was allegedly used in the buildup to the December 2024 hack of education tech firm PowerSchool, in which more than 70 million records were stolen.

“We're now seeing infostealers not just evolve technically, but also play a more central role operationally,” says DoubleYou’s Wardle. “Even nation-state actors are developing and deploying them.”

Ian Gray, director of analysis and research at the security firm Flashpoint, says that while infostealers are only one tool that cybercriminals will use, their prevalence may make it easier for cybercriminals to hide their tracks. “Even advanced threat actor groups are leveraging infostealer logs, or they risk burning sophisticated tactics, techniques, and procedures,” Gray says.

Lumma isn’t the first infostealer to be targeted by law enforcement. In October last year, the Dutch National Police, along with international partners, took down the infrastructure linked to the RedLine and MetaStealer malware, and the US Department of Justice unsealed charges against Maxim Rudometov, one of the alleged developers and administrators of the RedLine infostealer.

Despite the international crackdown, infostealers have proven too useful and effective for attackers to abandon. As Flashpoint’s Gray puts it, “Even if the landscape ultimately shifts due to the evolution of defenses, the growing prominence of infostealers over the past few years suggests they are likely here to stay for the foreseeable future. Usage of them has exploded.”

Authorities Carry Out Elaborate Global Takedown of Infostealer Heavily Used by Cybercriminals

An arson attack in Colorado had detectives stumped. The way they solved the case could put everyone at risk.

3 Teens Almost Got Away With Murder. Then Police Found Their Google Searches

When a formerly incarcerated “troubleshooter for the mafia” looked for a second career he chose the thing he knew best. He became a prison consultant for white-collar criminals.

_From Sam Bankman-Fried’s fraud-ridden crypto empire to Elizabeth Holmes’ sham biotech company to deepfakers on the internet bilking grandmas of their retirement savings, white-collar crime seems to touch every last corner of tech. For the business titan who may one day end up in custody and can’t count on a presidential pardon, it never hurts to know a guy._

_WIRED spoke with a self-described former “troubleshooter for the mafia” who was incarcerated in US penitentiaries for a decade and found a new role for himself on the outside: He became a prison consultant. Now he works with an array of white-collar offenders. He berates and curses the ears off his clients—but it’s all part of the no-bullshit approach he says he uses to help them reduce and optimize their time inside._

Once when I was in prison and we were walking out of the dining hall, I stopped and I looked out the window. I said, “Do you see it?” And the other inmates are like, “What?” I go, “It’s right there.” And they’re stopping and gazing into the sky. Then more people come out of the dining hall and start looking too, and before you know it, so do the correctional officers. Finally, I said: “Gee, see how easy it is to take control of stupid people?”

I had a prison psychiatrist say that I treated the prison system like it was my own personal amusement park. I was just having too good of a time in there. I would get on the telephone, calling home or whoever, and I’d go, “Well, if the staff hates me right now, they’re going to despise me by this weekend. I have something special planned. I really can’t say. The staff’s listening in on the phone calls.” So the weekend rolls around, they put extra staff members on duty, wondering, “All right, what’s the dude going to do?” I’m lying in my fucking bunk reading a book. I ain’t going to do shit. But I fucking manipulated these people.

I also spent my time helping people. I would help people who were over-sentenced on their charges get into RDAP, the Residential Drug Abuse Program, or an extra halfway house called the Second Chance Act program. I would go through their legal paperwork and say, “You know what? Let’s file in court on this,” and boom, all of a sudden somebody gets resentenced. That made me a folk hero. I thought, “Well shit, I could turn this into a business.”

When I first got out of custody, there was nobody doing this. My primary clients were people that had financial fraud. Some drug clients, but it was people who ripped people off. Your white-collar offenders. It’s people who are scared, angry, and confused. If they reach out to me before they’ve gone in, I can get them prepared.

Between people on the outside and people on the inside, I may have like 50 clients, maybe 100, at a time. Sometimes my services are free, sometimes they’re $3,500, $5,000, $10,000. I even had one guy pay me $50,000. It just depends on the person, their circumstance, what they can afford. I’ve got four other people who work with me, two women and two men.

When my clients come to me, I tell them: “OK, so shut the fuck up and listen to what I have to say. You’re in deep shit. I’m going to pull your head out of your ass, because your lawyer probably screwed you, made you false fucking promises that they can’t keep. First let’s take a look at your charges, your federal indictment. What are you charged with? Is it drugs? Is it some type of wire fraud?” And we’ll just break your case down.

I’m not a lawyer. I can’t give you legal advice. But what I can do is explain the law to you, and I can help you determine whether or not you should go to trial or take a plea agreement. I also teach my clients how to lie on the witness stand effectively, how to beat the polygraph machine. So I’m a full-service kind of business.

I got hit with narcotics trafficking, securities fraud, racketeering, obstruction of justice, and possession of machine guns. I’m not here to fucking judge anybody. I know within five minutes of seeing the indictment whether this person’s going to prison. There’s no question about it, unless they’re ratting people out.

So a dumbass gets sentenced. I have a chemical dependency assessment done on them to determine whether they have a substance abuse issue. If I have a report generated for them and it gets put into their probation report at sentencing and they submit it to the prison, it creates eligibility for them to get into a program to get out up to one year early.

I explain to them it’s not what they’ve seen on TV. I hold their hand and their family’s hand, because their families are busy watching prison shows and they’re all freaked out. I calm them down. Prison is boring. It’s Groundhog Day. Every day is the last day, unless people get into a fight or something. I explain to them the different types of prisons. A majority of my clients go to minimum security institutions, known as federal prison camps. Many have no fences, no walls. They often don’t lock the doors.

I’m teaching my clients the politics of prison life—how to deal with staff, how to deal with other inmates. You don’t want to hang out with informants or child molesters. And some of the staff members are fucking cuckoo. They’re unprofessional. They’re not well trained. They have their own emotional and personal issues.

I give people that psychological peace of mind. I have a lot of clients that are family members of people in custody. I’m like a cross between a marriage counselor, a psychologist, a life coach, and a priest. So that calms the people.

My wife said that I need to be nicer to the clients. I think maybe I’m desensitized because I’ve been doing this shit for so long. I get frustrated. I sometimes go off on people. I say, “I don’t know who’s dumber, you or a fucking lawyer, listen the fuck up.” I mean, my ex-wife said I didn’t have one ounce of human kindness. She knew me the best.

_—As told to Elana Klein_

What to Expect When You’re Convicted

The Take It Down Act requires platforms to remove instances of “intimate visual depiction” within two days. Free speech advocates warn it could be weaponized to fuel censorship.

US President Donald Trump signed into law legislation on Monday nicknamed the Take It Down Act, which requires platforms to remove nonconsensual instances of “intimate visual depiction” within 48 hours of receiving a request. Companies that take longer or don’t comply at all could be subject to penalties of roughly $50,000 per violation.

The law received support from tech firms like Google, Meta, and Microsoft and will go into effect within the next year. Enforcement will be left up to the Federal Trade Commission, which has the power to penalize companies for what it deems unfair and deceptive business practices. Other countries, including India, have enacted similar regulations requiring swift removals of sexually explicit photos or deepfakes. Delays can lead to content spreading uncontrollably across the web; Microsoft, for example, took months to act in one high-profile case.

But free speech advocates are concerned that a lack of guardrails in the Take It Down Act could allow bad actors to weaponize the policy to force tech companies to unjustly censor online content. The new law is modeled on the Digital Millennium Copyright Act, which requires internet service providers to expeditiously remove material that someone claims is infringing on their copyright. Companies can be held financially liable for ignoring valid requests, which has motivated many firms to err on the side of caution and preemptively remove content before a copyright dispute has been resolved.

For years, fraudsters have abused the DMCA takedown process to get content censored for reasons that have nothing to do with copyright infringements. In some cases, the information is unflattering or belongs to industry competitors that they want to harm. The DMCA does include provisions that allow fraudsters to be held financially liable when they make false claims. Last year, for example, Google secured a default judgment against two individuals accused of orchestrating a scheme to suppress competitors in the T-shirt industry by filing frivolous requests to remove hundreds of thousands of search results.

Fraudsters who may have feared the penalties of abusing DMCA could find Take It Down a less risky pathway. The Take It Down Act doesn’t include a robust deterrence provision, requiring only that takedown requestors exercise “good faith,” without specifying penalties for acting in bad faith. Unlike the DMCA, the new law also doesn’t outline an appeals process for alleged perpetrators to challenge what they consider erroneous removals. Critics of the regulation say it should have exempted certain content, including material that can be viewed as being in the public’s interest to remain online.

Another concern is that the 48-hour deadline specified in the Take It Down Act may limit how much companies can vet requests before making a decision about whether to approve them. Free speech groups contend that could lead to the erasure of content well beyond nonconsensual “visually intimate depictions,” and invite abuse by the same kinds of fraudsters who took advantage of the DMCA.

Since it receives millions of DMCA takedown requests annually, Google has said in court papers that it “often must rely” on the “accuracy of the statements submitted by copyright claimants.” It’s difficult to imagine that the process would be any different for Take It Down, says Becca Branum, deputy director of the free expression project at the Center for Democracy and Technology. (CDT receives a minority of its funding from Google and other tech companies.)

“Platforms have no incentive or requirement to make sure what comes through the system is nonconsensual intimate imagery,” Branum says. Because it’s often cheaper and easier for companies to comply with requests than to investigate them, she says, more content may be removed from the internet than deserves to be. Braum points to another set of laws passed by Congress about seven years ago addressing sex trafficking content, which she argues also led to the removal of unrelated information from the web.

Under their existing takedown processes for nonconsensual intimate imagery, some tech companies require requestors to show government-issued identification confirming that they are the person being depicted. But advocates for victims say the rules unfairly burden legitimate requestors and jeopardize their privacy.

Take It Down doesn’t require identity verification, and it’s possible that burdensome processes to request removals could trigger FTC scrutiny. Likewise, critics of Take It Down also may call on the FTC—which is typically aligned with the president’s political party—to investigate companies that allow bogus requests to sail through.

Ted Cruz and Amy Klobuchar, the bipartisan pair of senators who helped shepherd Take It Down through Congress with little opposition, didn’t respond to requests for comment about issues that have been raised with the legislation. For members of Congress, passing the bill was imperative to protecting people, like the teenagers whose experiences helped shape it. The hope is that future victims will get their privacy back without delay.

Trump Signs Controversial Law Targeting Nonconsensual Sexual Content

Sequoia Capital partner Shaun Maguire said in a webinar hosted by Israel’s Defense Ministry that he connected the IDF with SpaceX’s Starlink satellite internet far sooner than believed.

Prominent Silicon Valley venture capitalist Shaun Maguire said on a webinar last week that he personally facilitated getting the Israel Defense Forces access to Starlink satellite internet, which is operated by Elon Musk’s SpaceX, within hours or days of it beginning its military response in Gaza to Hamas’ attack on October 7, 2023—far earlier than either Israel, Musk, or SpaceX have publicly acknowledged.

The topic was initially broached by Tel Aviv–based venture capitalist Aviv Eyal, who was introducing Maguire at the beginning of the May 14 webinar titled “Why VCs Are Betting On Defense Tech." The webinar was hosted by the Israeli Defense Ministry's “Mafat for Startups,” a defense startup investment program run by its Directorate of Defense Research & Development.

It is unclear exactly when Starlink was activated for IDF use, even according to Eyal and Maguire’s recollections. Eyal initially claimed on the webinar that it took Maguire “12 hours, maybe less, to get Starlink switched on over Israel.” Maguire added that he believed Eyal contacted him some time between October 8 and October 9; later on the webinar, Maguire said that he brought Starlink to the IDF on October 9. Israel would not officially approve of SpaceX’s limited use in the country until more than four months later. It also appears that SpaceX did not have a contractual agreement with the Pentagon at the time it began providing Starlink to the IDF, which the Pentagon required before SpaceX could provide Starlink to Ukraine. The Pentagon did not respond to WIRED’s request for comment.

“There's always the most kind of chaos and opportunity in the immediate aftermath after a catastrophe like that,” Maguire said on the webinar.

Eyal also said that Maguire, who has invested in SpaceX, introduced him to the head of country licensing of Starlink at SpaceX, and “really helped shepherd us through the first couple of months of getting Starlink into the hands of the IDF.”

“And it went on to be an absolute game changer and a huge success,” Eyal said.

Eyal is the cofounder and managing partner of the venture capital firm Entrée Capital. It’s unclear what Eyal’s relationship with the IDF was at the time he reached out to Maguire. However, Maguire noted on the webinar that, in the initial days after the attack, both he and Eyal, “in our own ways, started getting involved and trying to help Israel just in the immediate aftermath.”

Maguire did not respond for comment. When reached by WIRED, Eyal said that his reply was off the record, a condition WIRED did not agree to. He said that the webinar “was held ‘off the record’ and stated as such at the start of the webinar.” However, this was not stated during the webinar nor in the event description.

“You misunderstood the conversion, and as such your questions are not on topic and any conclusions you draw and write will unfortunately be incorrect and just an embarrassment,” Eyal said in his message. “Shaun's role is incorrect, and the dates you quote are incorrect as well as other key info.”

Eyal did not reply to two follow-up messages that contained quotes from the webinar and offered Eyal the opportunity to correct or clarify anything that was said.

On October 20, 2023, the IDF launched an offensive in Gaza that specifically targeted the territory’s internet and telecommunications infrastructure. This resulted in a “complete disruption” of internet and cellular communication for the then 2.3 million people living there.

A few days later, Elon Musk began what would reportedly become tense negotiations with the Israeli Communications Ministry to provide Starlink access in the area. On October 28, Musk said on X that Starlink would “support connectivity to internationally recognized aid organizations in Gaza” in a reply to US representative Alexandria Ocasio-Cortez drawing attention to the communications blackout.

Israeli communications minister Shlomo Karhi, in a quote-post of Musk, said that Israel would “use all means at its disposal to fight this,” claiming that Hamas would find a way to access and use Starlink for “terrorist activities.”

“Perhaps Musk would be willing to condition it with the release of our abducted babies, sons, daughters, elderly people,” Karhi wrote. “All of them! By then, my office will cut any ties with starlink.”

Musk replied a few hours later, saying, “We are not so naive.”

“Per my post, no Starlink terminal has attempted to connect from Gaza,” Musk added. “If one does, we will take extraordinary measures to confirm that it is used \*only\* for purely humanitarian reasons. Moreover, we will do a security check with both the US and Israeli governments before turning on even a single terminal.”

The Israeli Communications Ministry did not approve any use of Starlink in Israel or Gaza until February 14, 2024. At that point, Kahri said in a post on X, Starlink could be used both in Israel and at a United Arab Emirates–run field hospital in Rafah.

“The use of the company's services will be limited at first with broader use expected in the future,” Kahri said in the post.

Eyal mentioned on the webinar that it is currently "a matter of weeks” before Starlink is “launched for Israel as a whole” and available to any person or business. It is unclear if this access will include the occupied West Bank and Gaza.

SpaceX, the IDF, and the Israeli Communications Ministry did not respond for comment.

According to Agence France-Presse, 1,189 Israelis died as a result of Hamas’ October 7 attack on Israel. Hamas also took 251 Israelis to Gaza as hostages, of which 58 remain, and 23 are believed to be alive.

Between 53,000 and 62,000 Palestinians have died as a result of Israel’s military offensive into Gaza that followed October 7, according to Gaza’s Ministry of Health and Government Media Office. The exact death toll is unclear, because there is an unknown number of bodies buried under the rubble of destroyed buildings. Israel has blocked any food or medical aid entering Gaza since the beginning of March, which aid workers say have resulted in increasingly catastrophic and dire living conditions.

A Silicon Valley VC Says He Got the IDF Starlink Access Within Days of October 7 Attack

WIRED loves a rogue. Except rogues ruined the internet. Is there any salvaging the rebellious spirit without destroying everything?

At WIRED, we’ve had a long-running obsession with rogues. This is, after all, a publication that was founded in the early ’90s, born of a desire to champion the subversive, disruptive advent of the internet—and the hackers, hustlers, and blue-sky lunatics consumed by the possibilities of a digitized and interconnected planet.

Of course, WIRED had no idea, then, just what those rogues would ultimately unleash: a proliferation of bad actors wreaking havoc across the web; a booming industry of online conspiracy theorists whose dangerous convictions threaten everything from the health of our children to the strength of our democracies; and a coterie of tech billionaires with checkbooks and megaphones that reach from Silicon Valley all the way to the White House. Yes, rogues built the internet and inspired a technological revolution. Now, a mutated and much more powerful version of that same lawless spirit threatens to undo much of the incredible progress that technology and scientific inquiry have unlocked. DOGE Boys: I’m looking at you.

In this edition of WIRED, we’re finding plenty of ways to show you just how roguish, how crooked, and how precarious our world has become. Matt Burgess brings you the inside story of Nigeria’s Yahoo Boys and the “scam influencer” teaching them how to pull sophisticated digital cons on American victims. From Andy Greenberg, a timeline of ghost guns culminating in the one that Luigi Mangione allegedly used to murder a health care CEO in broad daylight—an act that’s turned Mangione into the internet’s most beloved rogue in recent memory. (Scroll down to watch what happened when Andy tried to re-create that weapon himself.) And from Evan Ratliff, the sweeping, bone-chilling saga of the Zizians, a group of gifted young technologists who became the world’s first AI-inflected death cult and allegedly killed six people over several violent, chaotic years.

Scam influencers? DIY guns? AI death cults? Yes, things are rough out there. But we wouldn’t be WIRED without finding—and even creating—a little bit of roguish fun amid the gloom. Elsewhere in this issue, we’ll introduce you to a new and inspiring era of anti-establishment rebellion that’s taking root: Amber Scorah, the cofounder of a nonprofit that helps whistleblowers safely share information with the masses, is one such example. Another is Bluesky CEO Jay Graber, who sat down with Kate Knibbs to elaborate on her vision for a democratized social internet. Plus, our Gear experts will show you the slickest, most villainous products to outfit your supervillain lair.

If you take one thing from our Rogues Issue, I hope it’s this: “Rogue” is by no means a pejorative—even if it feels like more nasty bad actors than ever, perched in the highest seats of power, are running roughshod over pretty much everything. In fact, I’d argue that this moment calls for more rogues rather than fewer. The idealistic rogues. The indefatigable rogues. The new iteration of blue-sky lunatics who can imagine what a better world should look like—and are willing to fight the status quo to get us there. So be the rogue you want to see in the world, and know that WIRED, with every ounce of rebel spirit in our DNA, will be right there with you.

Who Even Is a Criminal Now?

In the wake of Luigi Mangione’s alleged killing of a health care CEO with a partially 3D-printed pistol, we built the exact same weapon ourselves—and test-fired it.

We 3D-Printed Luigi Mangione’s Ghost Gun. It Was Entirely Legal

Format Boy makes a living teaching Yahoo Boys, notorious West African scammers, how to use AI and deepfake technology to ensnare their next victims.

As soon as Format Boy answers the phone, I recognize his booming voice. I’ve spent weeks immersed in the influencer’s back catalog of videos and voice notes. Format Boy isn’t like other influencers: He doesn’t show his face, and he won’t tell me his real name. He isn’t posting motivational content or seeking lucrative brand deals. Instead, he’s teaching his audience how to orchestrate high-paying online scams.

Format Boy—as he styles himself on YouTube, Telegram, Instagram, and X, where he has amassed thousands of followers and racked up hundreds of thousands of views—acts as an unofficial adviser to a collective of menacing West African fraudsters known as the Yahoo Boys.

Typically these cybercriminals, mostly young men, work from their phones or laptops to con wealthy foreigners—often Americans—out of their life savings. Some have started using face-swapping and deepfakes to enhance their grifts. In one recent development, Yahoo Boys posted fake CNN broadcasts with AI-generated newscasters designed to trick people they’re blackmailing into thinking they’ve been outed on the news.

Often based in Nigeria, Yahoo Boys build elaborate relationships with their victims over weeks or months before they extract whatever cash they can. They’re not the most technically sophisticated scammers, but they’re agile and skillful social engineers. Victims in the US, UK, and elsewhere have lost millions to Yahoo Boys in recent years, and multiple teenage boys have reportedly taken their own lives after being blackmailed and sextorted by them.

Yahoo Boys have their own terminology—a code of sorts—that helps them run scams (and potentially avoid social media moderation teams). Victims are called “clients.” “Bombing” involves messaging hundreds of online accounts to see if someone responds. Scams are known as “formats” (hence the name Format Boy). And there are formats for all occasions. Romance and dating formats try to get people to fall in love; cops and FBI officials are mimicked in impersonation scams; Elon Musk formats pretend to be the centibillionaire. There are investment scams, gift card scams, the list goes on. Hundreds of scripts, which can be copied and pasted directly to a victim, float around the internet. One is called “50 Questions to Ask Your Client as a Yahoo Boy.”

There’s a whole hustle culture surrounding the Yahoo Boys. They pose with luxury cars and wear elaborate jewelry. On social media, hundreds of pages and groups, often explicitly using “Yahoo” in their names, claim to mentor newcomers, teach them the skills they need to con people, and provide them with the tools to do so.

Format Boy is one of the more prominent, or at least obvious, of these “scamfluencers”—his posts are often flagged by cybersecurity researchers who track the Yahoo Boys.

“I’m going to be teaching you guys exactly how to make a fake video call in this video,” Format Boy says at the start of his most popular YouTube video. Dramatic music blares as a deepfake video call is made onscreen. A brief text banner says it’s for educational purposes only. Six of Format Boy’s most popular videos, in fact, are all about creating deepfakes, with others detailing how Yahoo Boy scams work. “Fake video calls are very important,” he says in a voice note on Telegram. “Sometimes your clients cannot release some information to you without seeing you physically, without seeing you on camera.”

Illustration: Manuel Cetin

Format Boy started working around 2019, using a cheap phone to spam potential victims on dating sites. From there he got into the business of teaching people his methods and selling them software, guides, and tools. But on the phone with me, Format Boy is quick to distance himself from scamming. “It’s not something I really do personally,” he says, a claim he repeats multiple times, although he concedes he has at least some hands-on experience. “At some point I was doing it, but I eventually stopped, and I started doing … I went into video editing and AI research,” he says.

He complains that over the past three years YouTube has removed his channels multiple times, resetting his follower count on each occasion. When pushed, he admits that what he posts online could help people to break the law. “I won’t lie to you. That’s the truth; it’s encouraging them,” he says. He’s most active on his Telegram channel where he regularly sends messages and rambling voice notes—some up to nine minutes long—to his 15,000 subscribers. His posts give advice on things like how to build up trust with a “client” to gain access to their bank accounts, and recommendations and offers for AI software that Yahoo Boys can use to change their appearance on video calls with potential victims. In one post, he touts a Valentine’s Day promotional offer on this deepfake software—reduced from 60,000 Nigerian Naira (about $38) to 15,000 ($9.50).

I ask Format Boy how he feels about the impact Yahoo Boys have on their victims. He emphasizes his professional restraint. “I don’t teach them everything—even if they pay for it—because I feel like this is not the right thing to do normally,” he says. Many people in Nigeria feel that they have little help from the government, he adds. “This is why I teach, just so that they can know that even if they’re in the worst place in life, they can try something different for a while.”

In many of his voice notes on Telegram, Format Boy strikes an optimistic tone. Time is short, he says. Scammers need “determination” to succeed. “If you don’t plan well, you will fail well. If you plan well, you will succeed well,” he says in one voice note. “When I am giving you guys assignments,” he says in another, “I am not trying to play teacher. I’m trying to push you to your next level.”

Format Boy, like any influencer, is subject to the vicissitudes of the algorithm. Over the years he has begged for more engagement on his YouTube videos. In voice notes from December 2023, he said someone was pretending to be Format Boy online and had created false accounts. In another from early 2024, he said: “I feel like the stress on YouTube, all these platforms, is too much. I’m resigning.” Three days after quitting, he was back posting. But recently, he’s been planning his new hustle. His latest move, he tells me, is trading memecoins.

How to Win Followers and Scamfluence People

Amber Scorah and Psst are building a “digital safe” to help people shine a light on the bad things their bosses are doing, without getting found out.

Amber Scorah knows only too well that powerful stories can change society—and that powerful organizations will try to undermine those who tell them. In 2015, her 3-month-old son Karl died on his first day of day care. Heartbroken and furious that she hadn’t been with him, Scorah wrote an op-ed about the poor provision for parental leave in the US; her story helped New York City employees win their fight for improved family leave. In 2019 she wrote a memoir about leaving her tight-knit religion, the Jehovah’s Witnesses, that exposed issues within the secretive organization. The book cost her friends and family members, but she heard from many people who had also been questioning some of the religion’s controversial practices.

Then, while working at a media outlet that connects whistleblowers with journalists, she noticed parallels in the coercive tactics used by groups trying to suppress information. “There is a sort of playbook that powerful entities seem to use over and over again,” she says. “You expose something about the powerful, they try to discredit you, people in your community may ostracize you.”

In September 2024, Scorah cofounded Psst, a nonprofit that helps people in the tech industry or the government share information of public interest with extra protections—with lots of options for specifying how the information gets used and how anonymous a person stays.

Psst’s main offering is a “digital safe”—which users access through an anonymous end-to-end encrypted text box hosted on Psst.org, where they can enter a description of their concerns. (It accepts text entries only and not document uploads, to make it harder for organizations to find the source of leaks.)

To safely share secrets, tech whistleblowers can go to psst.org and enter details in an encrypted text-box.

Photograph: Ali Cherkis

What makes Psst unique is something it calls its “information escrow” system—users have the option to keep their submission private until someone else shares similar concerns about the same company or organization.

As the organization was preparing to launch, members of Psst’s team helped a group of Microsoft employees who were unhappy with how the company was marketing its AI products to fossil-fuel companies. Only one employee was willing to speak publicly, but others provided supporting documents anonymously. With help from Psst’s team of lawyers, the workers filed a complaint with the Securities and Exchange Commission against the company and aired their concerns in a story published by The Atlantic.

Combining reports from multiple sources defends against some of the isolating effects of whistleblowing and makes it harder for companies to write off a story as the grievance of a disgruntled employee, says Psst cofounder Jennifer Gibson. It also helps protect the identity of anonymous whistleblowers by making it harder to pinpoint the source of a leak. And it may allow more information to reach daylight, as it encourages people to share what they know even if they don’t have the full story.

Only members of Psst’s in-house legal team can access information in the safe. In countries including the US and UK, communications between lawyers and their clients usually benefit from legal privilege, meaning the information is kept confidential.

This is one reason tech companies have such large legal departments, says Gibson, who leads Psst’s in-house legal team: “They’re designed to put lawyers in the room so the information isn’t disclosable. To some extent, we’re using their playbook.”

Amber Scorah with Psst co-founders Jennifer Gibson and Rebecca Petras.

Photograph: Ali Cherkis

At the moment, Psst lawyers first manually review the entries in the safe without reading the contents. Users can tag their entries with the company name and the category of their concern—“trust and safety” or “fraud,” for instance. If the lawyers find matches, and the contributor consents, the lawyers decrypt and read the entries to see if they may form part of the same story, while keeping the different contributors’ identities protected from one another.

Psst plans to automate some of this process—in the future an algorithm running in a secure enclave built into the hardware of a computer will decrypt and compare information looking for potential matches while keeping it shielded from human eyes.

What happens next depends on various factors, but often Psst will involve an independent investigative journalist or publish accounts on its own website. Sometimes, whistleblowers might want to alert regulators without going public.

One challenge, Gibson says, is that regulation often lags behind technological advances, as with AI safety. “You’re then in this no-man’s-land,” she says—even if something’s not illegal, reporting it may be in the public interest.

Scorah hopes Psst’s impact on the tech world will be similar to what she experienced when telling her own stories, by using insiders’ accounts to shed light on broader industry issues. “Whether it’s a religion operating off the radar with policies that cause harm or an AI company whose product or policies are causing harm, I have seen the same thing,” she says. “Sunlight has a sanitizing effect.”

For Tech Whistleblowers, There’s Safety in Numbers

The company behind the Signal clone used by at least one Trump administration official was breached earlier this month. The hacker says they got in thanks to a basic misconfiguration.

During a recent cabinet meeting, President Donald Trump’s then national security adviser, Mike Waltz, must have been bored. Apparently unaware of the photographer behind him, he was caught clandestinely checking his Signal messages under the table.

Only he wasn’t using the official Signal app, which is widely considered to be the gold standard of encrypted messaging apps. He was actually using a clone of Signal called TeleMessage Signal, or TM SGNL. This app, made by TeleMessage (which was recently acquired by Smarsh), works in almost exactly the same way as Signal, except that it also archives copies of all the messages passing through it, shattering all of its security guarantees.

Two days after the photo of Waltz was published, an anonymous source told me that they had hacked TeleMessage. “I would say the whole process took about 15 to 20 minutes,” the hacker said, as Joseph Cox and I reported in 404 Media. “It wasn’t much effort at all.” Representatives from TeleMessage and Smarsh did not respond to a request for comment.

The exploit that the hacker used was incredibly simple. At the time, we chose not to publish any details about it because it would be so easy for others to replicate. Since then, TeleMessage has temporarily suspended all services, which is now why WIRED can share exactly how this hack took place without risking anyone’s private data.

“I first looked at the admin panel **secure.telemessage.com** and noticed that they were hashing passwords to MD5 on the client side, something that negates the security benefits of hashing passwords, as the hash effectively becomes the password,” the hacker said. (Hashing is a way of cryptographically obfuscating a password stored on a system, and MD5 is an inadequate version of the algorithms used to do so.) Drop Site News has since reported that it appears that this admin panel exposed email addresses, passwords, usernames, and phone numbers to the public.

The weak password hashing, and the fact that the TeleMessage site was programmed with JSP—an early 2000s-era technology for creating web apps in Java—gave the hacker “the impression that their security must be poor.” Hoping to find vulnerable JSP files, the hacker then used feroxbuster, a tool that can quickly find publicly available resources on a website, on **secure.telemessage.com**.

The hacker also used feroxbuster on **archive.telemessage.com**, another domain used by TeleMessage, which is where they discovered the vulnerable URL, which ended in **/heapdump**.

When they loaded this URL, the server responded with a Java heap dump, which is a roughly 150-MB file containing a snapshot of the server’s memory at the moment the URL was loaded.

The hacker said they “knew from past experience that heap dumps from web servers” will include the “bodies” of http requests, they said, “and this may include credentials of users logging in.” And for TM SGNL, they did. By downloading a heap dump and then searching for “password,” the hacker could see usernames and passwords of random users.

They tried logging into **secure.telemessage.com** using a pair of these credentials and discovered that they had just hacked a user with an email address associated with US Customs and Border Protection, one of the agencies implementing Trump’s draconian immigration policy. CBP has since confirmed that it was a TeleMessage customer.

After spending a few more minutes digging through the heap dump, the hacker also discovered plaintext chat logs. “I can read Coinbase internal chats, this is incredible,” the hacker said. (Coinbase did not respond to WIRED's request for comment, but did tell 404 Media that “there is no evidence any sensitive Coinbase customer information was accessed or that any customer accounts are at risk, since Coinbase does not use this tool to share passwords, seed phrases, or other data needed to access accounts.”)

At this point, the hacker says they had spent 15 to 20 minutes poking at TeleMessage’s servers, and had already compromised one of their federal government customers, along with one of the world’s biggest cryptocurrency exchanges.

As I discovered from analyzing TM SGNL’s source code, TeleMessage apps—like the one running on Mike Waltz’s phone—uploaded unencrypted messages to **archive.telemessage.com** (I call this the archive server), which then forwards the messages to the customer’s final destination. This contradicts TeleMessage’s public marketing material, where they claimed TM SNGL uses “end-to-end encryption from the mobile phone through to the corporate archive.”

The archive server is programmed in Java and is built using Spring Boot, an open source framework for creating Java applications. Spring Boot includes a set of features called Actuator that helps developers monitor and debug their applications. One of these features is the heap dump endpoint, which is the URL the hacker used to download heap dumps.

According to Spring Boot Actuator’s documentation: “Since Endpoints may contain sensitive information, careful consideration should be given about when to expose them.” In the case of TeleMessage’s archive server, the heap dumps contained usernames, passwords, unencrypted chat logs, encryption keys, and other sensitive information.

If anyone on the internet had loaded the heap dump URL right as Mike Waltz was texting using the TM SGNL app, the heap dump file would have contained his unencrypted Signal messages, too.

A 2024 post on the cloud security company Wiz’s blog lists “Exposed HeapDump file” as the number one common misconfiguration in Spring Boot Actuator. “Up until version 1.5 (released in 2017), the /heapdump endpoint was configured as publicly exposed and accessible without authentication by default. Since then, in later versions Spring Boot Actuator has changed its default configuration to expose only the /health and /info endpoints without authentication (these are less interesting for attackers),” the author wrote. “Despite this improvement, developers often disable these security measures for diagnostic purposes when deploying applications to test environments, and this seemingly small configuration change may remain unnoticed and thereby persist when an application is pushed to production, inadvertently allowing attackers to obtain unauthorized access to critical data.”

In a 2020 post on Walmart’s Global Tech Blog, another developer gave a similar warning. “Apart from /health and /info, all actuator endpoints are risky to open to end users because they can expose application dumps, logs, configuration data and controls,” the author wrote. “The actuator endpoints have security implications and SHOULD NEVER EVER be exposed in production environment.”

The hacker’s quick exploit of TeleMessage indicates that the archive server was badly misconfigured. It was either running an eight-year-old version of Spring Boot, or someone had manually configured it to expose the heap dump endpoint to the public internet.

This is why it took a hacker about 20 minutes of prodding before it cracked open, with sensitive data spilling out.

Despite this critical vulnerability and other security issues with TeleMessage’s products—most notably, that the Israeli firm that builds the products can access all its customer’s chat logs in plaintext—someone in the Trump administration deployed it to Mike Waltz’s phone while he was serving as national security adviser.

Source

Wired