Scattered Spider SMS phishing and SIM-swap crypto theft campaign
Campaign
Summary
Hide ▲
Show ▼
The Scattered Spider campaign used SMS phishing and SIM swap attacks to steal employee credentials, hijack phone numbers, and take over email and virtual currency wallets across at least a dozen companies. The operation, active from September 2021 to April 2023, relied on fake login pages to capture credentials and personal information before turning access into theft and account compromise. Prosecutors say the activity caused at least $8 million in cryptocurrency losses and showed a coordinated social-engineering effort across multiple sectors. Recent court action added that Tyler Robert Buchanan, described as a British man believed to lead the group, pleaded guilty in the United States to wire fraud and aggravated identity theft in the same crypto-theft case.
Related Happenings
U.S. consumers saw a surge in crypto ATM scam losses in 2025
Target Trend
First: 19.05.2026 22:45
Last: 19.05.2026 22:45
Sources 1
About this happening:
Law-enforcement complaint data shows **crypto ATM/cryptocurrency kiosk scams** drove sharply higher losses across **U.S. consumers** in **2025**, increasing the risk of large, irr...
U.S. consumers saw a surge in crypto ATM scam losses in 2025
Target TrendAbout this happening: Law-enforcement complaint data shows **crypto ATM/cryptocurrency kiosk scams** drove sharply higher losses across **U.S. consumers** in **2025**, increasing the risk of large, irr...
Tycoon2FA device-code phishing campaign targeting Microsoft 365
Campaign
First: 17.05.2026 17:43
Last: 17.05.2026 17:43
Sources 1
About this happening:
The **Tycoon2FA** phishing operation added **device-code phishing** to hijack **Microsoft 365** accounts, expanding its ability to steal access tokens and reach email, calendar, a...
Tycoon2FA device-code phishing campaign targeting Microsoft 365
CampaignAbout this happening: The **Tycoon2FA** phishing operation added **device-code phishing** to hijack **Microsoft 365** accounts, expanding its ability to steal access tokens and reach email, calendar, a...
Grafana Labs Says GitHub hit by cyberattack
Incident
First: 17.05.2026 10:13
Last: 17.05.2026 10:13
Sources 1
About this happening:
A **Grafana Labs** incident was later tied to the **Mini Shai-Hulud** supply-chain campaign against **TanStack npm packages**. Grafana said an unauthorized party used a token to a...
Grafana Labs Says GitHub hit by cyberattack
IncidentAbout this happening: A **Grafana Labs** incident was later tied to the **Mini Shai-Hulud** supply-chain campaign against **TanStack npm packages**. Grafana said an unauthorized party used a token to a...
ShinyHunters school-by-school extortion campaign targeting Canvas institutions
Campaign
First: 11.05.2026 13:05
Last: 11.05.2026 13:05
Sources 1
About this happening:
ShinyHunters intensified a **school-by-school extortion campaign** against **Canvas-related institutions**, increasing pressure on schools and universities as the group threatened...
ShinyHunters school-by-school extortion campaign targeting Canvas institutions
CampaignAbout this happening: ShinyHunters intensified a **school-by-school extortion campaign** against **Canvas-related institutions**, increasing pressure on schools and universities as the group threatened...
Google sponsored search ManageWP phishing campaign
Campaign
First: 07.05.2026 00:36
Last: 07.05.2026 00:36
Sources 1
About this happening:
A **phishing campaign** is abusing **Google sponsored search results** to impersonate **ManageWP** and steal login credentials, **2FA codes**, and account access. The operation ma...
Google sponsored search ManageWP phishing campaign
CampaignAbout this happening: A **phishing campaign** is abusing **Google sponsored search results** to impersonate **ManageWP** and steal login credentials, **2FA codes**, and account access. The operation ma...
Timeline
-
20.04.2026 16:33 3 articles · 1mo ago
Tyler Robert Buchanan pleads guilty in U.S. crypto-theft case
Legal Policy Action UpdateTyler Robert Buchanan, a British man believed to lead Scattered Spider, pleaded guilty in the United States to wire fraud and aggravated identity theft after prosecutors said he and four other suspects stole at least $8 million in cryptocurrency from at least a dozen companies using SMS phishing and SIM swap attacks. The scheme used fake login pages to capture employee credentials and personal information, then hijacked email accounts, phone numbers, and virtual currency wallets; Buchanan is scheduled to be sentenced on August 21, 2026.
Show sources
- British Scattered Spider hacker pleads guilty to crypto theft charges — www.bleepingcomputer.com — 20.04.2026 16:33
- British Scattered Spider hacker pleads guilty to crypto theft charges — www.bleepingcomputer.com — 20.04.2026 16:33
- Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms — krebsonsecurity.com — 24.09.2025 14:48