Alleged SIM Swapper Ransomed Instagram Influencer For Dates, Striptease Video

Disclaimer: This article includes descriptions of sexual abuse.

A 24-year-old alleged SIM swapper who lived in a luxury high-rise apartment in Los Angeles took over female influencers’ Instagram accounts and then tried to extort dates and explicit videos out of his victims, according to newly filed court records.

The news highlights an often overlooked side of the SIM swapping underground, where a hacker hijacks a victim’s phone number to break into accounts: how some hackers are not only motivated by financial gain, but sometimes also hack to sexually abuse their victims, who are typically women, too.

“The subject told Victim 3 that every time ‘he hacks girls, he makes them show themselves.’” a criminal complaint against Amir Hossein Golshan reads.

Are you a SIM swapper? Are you a victim of these sorts of attacks? We’d love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, or email joseph.cox@vice.com.

The complaint, written by an FBI Special Agent who is part of the Los Angeles Cyber Fraud Task Force, says that the FBI identified Golshan’s high-rise apartment in January 2023, after investigating his suspected involvement in a series of SIM swapping cases. The FBI tracked the activity to Golshan based on his connection to an IP address that was used to access a victim’s accounts, and a victim’s identification of Golshan as the party responsible with whom she had a video call, among other evidence, the complaint reads.

The complaint describes several cases where Golshan allegedly took over female influencers’ phone numbers, and then broke into their Instagram accounts. He sometimes allegedly sent messages to the victim’s friends to solicit money. In one case, a victim declined to provide Golshan with $1,000 to get her account back. Golshan then said he would return the account if the victim started a video call and stripped for him instead, according to the complaint. In that instance, the victim compiled while Golshan masturbated, the complaint adds.

The victim told the FBI that she spoke on the call for around an hour “and was trying to be nice to him so that he would give her account back.” During that conversation, Golshan claimed he hacked his neighbor when he lived at a particular apartment complex, the complaint says. The hacker claimed he broke into the neighbor’s bank account and obtained copies of her medical records. That neighbor then paid thousands of dollars to get her accounts back, according to the victim who had a video call with Golshan.

Golshan gave the victim her Instagram account back, but continued to call and text her, “including asking her out to dinner,” the complaint reads. The victim declined and did not respond further, at which point Golshan allegedly retook control of the victim’s Instagram account and deleted it. “I believe that the subject retook Victim 3’s Instagram account using a recovery code that he most likely saved when he was in control of the account,” the FBI agent writes.

The FBI also received data from cryptocurrency exchange Coinbase on Golshan’s alleged usage of the platform. Those records showed the account’s virtual currency wallets received around $423,575 between December 2018 and April 2022. Golshan’s bank records also showed he received around 165 Zelle payments for $23,790 from various people, according to the complaint. Most of these payments referenced Instagram account names and the word “verification,” the complaint adds. One $1 payment included the message “You fucking creep stealing money from a 14,” which the FBI believes refers to a 14-year-old person. The payments appear to be related to a scam verification service, the complaint suggests.

The FBI eventually tracked down Golshan by tracking the location of his phone and finding where the IP address he used resolved to. That information led to another particular apartment complex in Los Angeles.

Messages Motherboard sent to Golshan’s alleged Telegram and email accounts went unanswered.

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.

READ MORE HERE