Loading story…
Bryan Fleming, the founder of the Michigan-based company pcTattletale, has pleaded guilty in a San Diego federal court to charges of computer hacking and the illegal advertising and sale of stalkerware. Fleming admitted to selling software designed to secretly monitor individuals, including romantic partners, by capturing text messages, photos, GPS locations, and even screen activity, all without the victim's knowledge. The software was marketed and sold online for a subscription fee, with explicit advertising targeting those wishing to spy on spouses or partners. Federal investigators, including agents from Homeland Security Investigations, began probing Fleming's activities in 2021, using undercover operations and search warrants to gather evidence of the software's use and marketing for illegal surveillance.
This case marks only the second successful federal prosecution of a consumer spyware vendor in the United States in over a decade, highlighting the legal risks for operators of stalkerware products. Court documents revealed that Fleming was unusually public about his business, even producing YouTube videos demonstrating the software's stealth features. The plea agreement was facilitated by evidence that the software was sold across state lines, allowing federal jurisdiction. Authorities raided Fleming's Michigan home as part of the investigation, and the case underscores ongoing law enforcement efforts to crack down on the commercial distribution of surveillance tools marketed for unlawful purposes.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
In San Diego federal court, pcTattletale founder Bryan Fleming was sentenced to time served and ordered to pay a $5,000 fine after previously pleading guilty to federal charges tied to making, selling, and advertising spyware for unlawful uses.
Bryan Fleming, creator of pcTattletale, pleaded guilty in federal court to charges tied to selling software designed to illegally intercept communications and advertising surveillance capabilities for misuse. The plea marked a rare successful US federal prosecution of a consumer spyware or stalkerware vendor.
In 2024, a hack exposed sensitive data tied to more than 138,000 pcTattletale customer accounts and victims. The breach led to the shutdown or collapse of the company behind the stalkerware product.
A purchase of pcTattletale in California enabled US federal authorities to pursue the case, helping establish jurisdiction for the later prosecution of founder Bryan Fleming.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberscoop.com
Open sourcetechcrunch.com
Open sourcetherecord.media
Open sourcebitdefender.com
Open sourcehackread.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An international law enforcement operation disrupted the **Imminent Monitor** remote access trojan (RAT), a malware tool marketed online as legitimate remote administration software but widely used for cybercrime. Researchers at Palo Alto Networks Unit 42 said they collected more than **65,000** samples and observed over **115,000** attacks tied to the malware, which included stealth and persistence features, antivirus-evasion tooling, hidden keylogging, and later cryptocurrency-mining capability. Investigators linked the malware’s developer, known as **"Shockwave™"**, to Australia and referred the case to the Australian Federal Police, which worked with partners including the FBI and Canada’s CRTC to support **Operation Cepheus** and disable the RAT’s licensing infrastructure. The takedown exposed purchaser records and triggered enforcement against suspected users, with authorities reporting **85 warrants**, **434 device seizures**, and **13 arrests**. In the UK, that investigation led to the conviction of **Scott Cowley** of St Helens, Merseyside, who was sentenced to two years in prison after forensic analysis found he had used Imminent Monitor to hijack the webcams of three women and secretly record them in their bedrooms. The case underscored how a commodity RAT sold to thousands of customers was used not only for intrusion and surveillance, but also for sexual abuse and other criminal activity.
Aug 15, 2026
Peter Williams, a former executive at L3Harris subsidiary Trenchant, pleaded guilty in U.S. federal court to two counts of theft of trade secrets after admitting to selling at least eight sensitive cyber-exploit components, including zero-day vulnerabilities, to a Russian software broker. The stolen materials, intended exclusively for the U.S. government and its allies, were sold over a three-year period from 2022 to 2025 in exchange for millions of dollars in cryptocurrency. U.S. prosecutors stated that Williams signed multiple contracts with the Russian broker, which publicly advertises itself as a reseller of cyber exploits to clients including the Russian government, and that the offenses cost L3Harris $35 million in damages. Williams, who previously worked for the Australian Signals Directorate, used encrypted communications to facilitate the transactions and used the proceeds to purchase luxury items. The Russian broker, identified in court as "Company 3" and believed to be Operation Zero, is known for seeking mobile exploits for non-NATO clients. Williams faces a potential prison sentence of 87 to 108 months, fines up to $300,000, and restitution of $1.3 million, and is currently under house arrest pending sentencing. Authorities highlighted the national security risks posed by the sale of these sophisticated cyber tools to foreign actors outside the U.S. and its allies.
Jun 29, 2026
U.S. prosecutors charged 19-year-old dual U.S.-Estonian citizen Peter Stokes over an alleged **Scattered Spider** intrusion in which attackers socially engineered a luxury retailer’s IT help desk, reset credentials and MFA, accessed privileged accounts, stole data, and attempted to extort the company for **$8 million** in cryptocurrency. Court filings say the May 2025 attack caused roughly **$2 million** in operational losses even though the victim restored access without paying, and investigators say at least **77 GB** of data was exfiltrated during the breach. Authorities said Microsoft telemetry played a central role in identifying Stokes, with a persistent Windows **Global Device Identifier** (`GDID`) tying activity from the intrusion to his device and online accounts. Investigators also linked infrastructure used in the attack, including **ngrok** tunneling and a **Tzulo**-hosted VPN proxy, before correlating the same identifier with accounts on Apple, Snapchat, Facebook, and Ubisoft/Growtopia across locations including Estonia, New York, and Thailand. Stokes was arrested in Finland while attempting to board a flight to Japan, extradited to the United States, and now faces federal charges including conspiracy, computer intrusion, wire fraud, and violations of the **Computer Fraud and Abuse Act**.
Jul 12, 2026