Illinois Man Pleads Guilty to Phishing Scheme Targeting Snapchat Users
In a startling development, Kyle Svara, a 27-year-old resident of Oswego, Illinois, has pleaded guilty to charges tied to a sophisticated phishing and account-compromise scheme that primarily targeted Snapchat users. This illicit operation led to the unauthorized theft of private images from numerous women. Federal prosecutors have laid out a range of charges against Svara, which include aggravated identity theft, wire fraud, computer fraud, conspiracy to commit computer fraud, and making false statements related to child sexual abuse material. U.S. District Judge Brian E. Murphy has set a sentencing date for May 18, 2026.
From at least May 2020 through February 2021, Svara allegedly orchestrated an extensive social engineering campaign aimed explicitly at Snapchat users. He meticulously gathered personal information such as email addresses, telephone numbers, and Snapchat usernames of his victims. Following this data collection, he engaged in account access or password-recovery processes designed to lead Snap Inc. to send legitimate security codes to unsuspecting users.
Employing a strategic approach, Svara utilized anonymized telephone numbers to impersonate a representative from Snap Inc., crafting text messages that solicited these security codes. This method leverages a prevalent phishing technique: rather than attempting to bypass the platform’s sophisticated authentication controls, the attacker simply persuades the victim to voluntarily disclose valid and time-sensitive verification codes.
Prosecutors disclosed that Svara sent out text messages to more than 4,500 individuals during the course of his operation. Alarmingly, approximately 570 women unwittingly provided their Snapchat access codes, affording him unauthorized entry into at least 595 accounts. Once granted access, he proceeded to download nude or semi-nude images, subsequently retaining, selling, or trading this stolen content through various internet forums and private transactions.
Further investigations revealed that Svara even advertised his hacking services online. He made posts on platforms such as Reddit, boasting that he could “get into girls’ Snap accounts” to procure content for prospective buyers or trading partners. This alarming behavior illustrates how account-recovery features, while essential for authentic users, become prime targets for malevolent social engineers seeking to exploit SMS-based verification for their own gain.
A deeper dive into the investigation revealed a connection to a broader scheme involving Steve Waithe, a former track and field coach at Northeastern University. Waithe allegedly hired Svara and paid him to compromise Snapchat accounts belonging to female athletes he coached or was acquainted with. Waithe faced his own justice as he was convicted in November 2023 on multiple charges, including wire fraud, cyberstalking, computer fraud, and conspiracy. He was sentenced to five years in prison, followed by an additional three years of supervised release, highlighting the severe consequences of such criminal activities.
In addition to the accounts associated with Waithe, evidence suggests that Svara expanded his exploits to encompass women residing in and around Plainfield, Illinois, as well as students from Colby College in Waterville, Maine. Despite facing investigators, Svara allegedly denied all involvement in the Snapchat hacking and claimed that he never sought or accessed child sexual abuse material. However, the evidence gathered by investigators pointed to the contrary; they established that he had not only collected but also distributed and solicited such material, as stated by the U.S. Attorney’s Office for the District of Massachusetts.
The Federal Bureau of Investigation (FBI) has taken an active stance in this case, urging potential victims or individuals possessing relevant information to report their experiences via the FBI’s victim-assistance form.
This unsettling case serves as a cautionary tale about the perils of account security and emphasizes the critical importance of never sharing one-time security codes, even with individuals claiming to represent legitimate technology platforms. As technology continues to advance, so do the tactics of cybercriminals, making it increasingly essential for users to remain vigilant in protecting their private information. The chilling ramifications of this scheme and its links to a broader network of deceit underscore the necessity for robust security measures in an increasingly digital world.