22 He sometimes passed this information along to co-conspirators around the world. 21 In addition to the intimate material he seized from victims’ computers, federal authorities also found credit card and other online account information consistent with identity theft. The videos he surreptitiously recorded showed victims in various states of undress, getting out of the shower, and having sex with partners. 20 His scheme reached as far away as New Zealand. 19 Of those, 44 of his victims were determined to be minors. 18 Mijangos possessed files associated with 129 computers and roughly 230 people. In all, federal investigators found more than 15,000 webcam-video captures, 900 audio recordings, and 13,000 screen captures on his computers.
To make matters worse, Mijangos also used the computers he controlled to spread his malware further, propagating to the people in his victims’ address books instant messages that appeared to come from friends and thereby inducing new victims to download his malware. In at least one case, he posted nude photos of a victim on the Myspace account of a friend of the victim, which Mijangos had also hacked, after she refused to comply with his demands. 14 He then, according to court documents, “used intimate images or videos of female victims he stole or captured to ‘sextort’ those victims, threatening to post those images or videos on the Internet unless the victims provided more.” 15 In some cases, he tricked victims into creating pornographic images and videos by assuming the online identity of the victims’ boyfriends. The malware Mijangos wrote was sophisticated, and he told federal authorities that he designed it specifically to be undetectable to antivirus programs. 12 And if they did, he would then threaten them further, notifying them that he knew they had told someone. 11 Mijangos used a keylogger – a tool that allowed him to see everything typed on a computer – to track whether the victims told friends and family or law enforcement about his scheme. 10 He kept detailed files on many of his victims, at times gathering information for more than a month, and filling his files with information he could later use to manipulate his victims. 9 And it allowed him to, at will, turn on any web camera and microphone attached to the computer, a capability he used to watch, listen, and record his victims without their knowledge. 8 It allowed him to see everything typed on their keyboards.
The malicious software he employed provided access to all files, photos, and videos on the infected computers. Mijangos, they discovered, had tricked scores of women and teenage girls into downloading malware onto their computers.
Law enforcement authorities investigating the emails soon realized that the threatening communications were part of a larger series of crimes. Lattimore, Cassia Spohn, and Matthew DeMichele April 2021 7 But all emails came from the same IP address in Santa Ana. Mijangos had other identities too: Some emails came from sometimes he was 6 According to court records in his federal criminal prosecution, Mijangos used at least 30 different screen names to avoid detection. On November 5, 2009, sent an email to another woman with the subject line: “who hacked your account READ it!!!” 4In the email, Mijangos attached a naked photo of the victim and told her “im in control of your computers right now.” 5 Located in Santa Ana, California, his name was Luis Mijangos. This victim knew her correspondent only as but the attacker turned out to be a talented 32-year-old proficient in multiple computer languages. Later in the day, to underscore his seriousness, the hacker followed up with another email threatening the victim: “You have six hours.” 2 And if she did not send it within one day, he threatened to publish the images already in his possession, and “let family know about dark side.” If she contacted law enforcement, he promised he would publish the photos on the Internet too. The perpetrator wanted a pornographic video of the victim. The demand made this hack different: This computer intrusion was not about money. Following that were details of her personal life: her husband and her three kids. When the victim opened the email, she found sexually explicit photos of herself attached and information that detailed where she worked.
It started with an email from an unknown sender with the subject line, “Read this and be smart.” 1