Loading story…
Australian national Michael Clapsis was sentenced to 7 years and 4 months in prison for orchestrating a series of sophisticated Wi-Fi attacks at airports and on commercial flights. Using a portable hacking device, Clapsis created 'evil twin' Wi-Fi hotspots that mimicked legitimate networks, tricking travelers into connecting and entering their credentials on fake login pages. This allowed him to harvest sensitive information, including email and social media credentials, as well as intimate photos and videos from multiple victims. The investigation, led by the Australian Federal Police, uncovered that Clapsis had been stealing private images from women’s online accounts for years, with over 700 photos and videos taken from at least 17 victims, some of whom were minors. He also attempted to destroy evidence by deleting files and remotely wiping his phone after police executed a search warrant.
The court found that Clapsis not only targeted random travelers but also unlawfully accessed his employer’s laptop to monitor confidential meetings about the investigation. The case highlights the dangers of public Wi-Fi and the effectiveness of 'evil twin' attacks, where rogue access points are set up to intercept user data. Security experts recommend avoiding public Wi-Fi when possible, using VPNs, and disabling automatic connections to open networks. The sentencing serves as a warning to both cybercriminals and the public about the severe consequences and risks associated with exploiting unsecured wireless networks.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
An Australian man was jailed for more than seven years for conducting evil twin Wi‑Fi attacks that stole data from victims using airport and in-flight wireless networks. The sentencing marks the key law-enforcement outcome described across the referenced reports.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Former U.S. Army soldier Cameron John Wagenius, known online as `kiberphant0m` and `cyb3rph4nt0m`, was sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies from April 2023 through December 2024. He pleaded guilty to wire-fraud conspiracy, computer-fraud-related extortion, aggravated identity theft, and unlawful transfers of confidential phone records, and was ordered to pay **$294,978** in restitution. Wagenius and co-conspirators used stolen network credentials—including credentials obtained through the SSH Brute tool he helped develop—to access victim systems, steal data, demand ransoms, and sell stolen information through Telegram, BreachForums, and XSS.is. Prosecutors said the group sought at least $1 million and used compromised records in SIM-swapping fraud; the activity was also linked to the 2024 Snowflake customer-data theft and extortion campaign, which affected more than 165 organizations, including AT&T.
Sep 28, 2026
Former U.S. Army soldier Cameron John Wagenius, known online as `kiberphant0m`, was sentenced to 70 months in federal prison and ordered to pay $294,978 in restitution for hacking, data theft and extortion targeting telecommunications companies and other organizations. Prosecutors said Wagenius and co-conspirators obtained credentials for at least 10 victims between April 2023 and December 2024, stole and sold sensitive data, demanded ransoms, and used records in SIM-swapping fraud. He pleaded guilty to wire-fraud conspiracy, computer-fraud-related extortion, aggravated identity theft, and unlawful transfers of confidential phone records. While stationed at Fort Cavazos, Wagenius used the credential-stealing tool SSH Brute, which he helped develop, and collaborated with Connor Moucka and alleged co-conspirator John Erin Binns. The operation was tied to the Snowflake customer-data theft wave, in which stolen credentials and accounts lacking multifactor authentication enabled theft of billions of records, including call and text metadata affecting more than 100 million AT&T customers. AT&T paid a $370,000 Bitcoin ransom; the group later posted purported call logs for Donald Trump and Kamala Harris and alleged NSA schematics. Wagenius also allegedly tried to sell stolen data to a foreign intelligence service and, while awaiting sentencing, sought exploit and escape-related guidance through other inmates' email accounts; authorities said they found no evidence he compromised Bureau of Prisons systems.
Sep 28, 2026
Recent court actions highlighted multiple **cyber-enabled crimes** resulting in prison sentences and follow-on legal measures. In the US, federal authorities announced sentencing and impending deportation of two Venezuelan nationals tied to a multi-state **ATM jackpotting** scheme that used **Ploutus** malware to force cash-out from legacy ATMs, with theft totaling hundreds of thousands of dollars and investigations linking activity to a broader network associated with **Tren de Aragua**. Separately in France, a Romanian national was sentenced in Paris to a five-year term with one year suspended (effectively four years to serve) for involvement in **ransomware** attacks using the **“Umbrella”** ransomware, with reported damages nearing €1 million and related cases spanning multiple European countries. In a separate, unrelated case, **Ilya Lichtenstein**—convicted for stealing **120,000 bitcoins**—publicly sought a “second chance” and a cybersecurity job after serving a 60-month sentence and being moved to home confinement, citing efforts to rehabilitate and cooperate. Collectively, the reporting underscores ongoing law-enforcement focus on financially motivated cybercrime ranging from malware-assisted physical compromise of financial infrastructure to enterprise-targeting ransomware, alongside continued public attention on high-profile cryptocurrency theft prosecutions.
Jun 29, 2026