Loading story…
Michael Smith of Cornelius, North Carolina, pleaded guilty in federal court in the Southern District of New York to conspiracy to commit wire fraud after prosecutors said he used artificial intelligence to generate hundreds of thousands of songs and then inflated their popularity with automated bot accounts on major music streaming platforms. Authorities said the operation ran from 2017 through 2024, using bulk email registrations, scripted playback, and cloud infrastructure to create fake listeners and stream Smith’s catalog billions of times while spreading activity across many tracks to avoid detection.
Prosecutors said the scheme diverted royalty payments from legitimate artists and rights holders and generated more than $8 million in fraudulent proceeds, with some reports putting the total at more than $10 million. Smith agreed to forfeit $8,091,843.64, and he now faces sentencing on July 29, 2026; the FBI investigated the case and the Southern District of New York’s Complex Frauds and Cybercrime Unit is prosecuting it.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Following his guilty plea, Smith's sentencing was set for July 29, 2026. The conspiracy charge carries a maximum prison sentence of five years.
Michael Smith pleaded guilty in federal court in the Southern District of New York to conspiracy to commit wire fraud for manipulating music streaming platforms with AI-generated songs and bot-driven streams. Prosecutors said the scheme generated more than $8 million in fraudulent royalties, and Smith agreed to forfeit $8,091,843.64.
Prosecutors said Michael Smith operated a music streaming fraud scheme from 2017 through 2024, using AI-generated songs, thousands of bot accounts, automated playback, and cloud infrastructure to inflate streams and divert royalty payments from legitimate artists and rights holders.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors charged **Kwamaine Jerell Ford**, a 34-year-old Georgia man, with running a long-term social-engineering and account-takeover scheme that targeted **NBA and NFL players** by stealing their **Apple/iCloud credentials** and, in some cases, **multifactor authentication codes**. According to the indictment described by multiple reports, Ford allegedly impersonated a well-known adult film actress on social media to lure athletes into sharing access to their accounts, then used stolen financial and personal data to conduct unauthorized purchases and other fraud. Authorities say the activity ran from **November 2020 through September 2024**, involved more than **2,000 unauthorized transactions**, and led to charges including wire fraud, computer fraud, access device fraud, aggravated identity theft, and sex trafficking; Ford has pleaded **not guilty** and is being held without bail. The case is notable because prosecutors say Ford resumed similar criminal activity while still serving a sentence for an earlier phishing campaign that had also targeted athletes and celebrities. One report says evidence from seized devices showed he began phishing professional athletes again within days of being released to home confinement during the pandemic, while another says some of the alleged conduct occurred while he was still in federal prison. Prosecutors also allege the scheme escalated beyond financial theft: Ford is accused of coercing a woman into sexual encounters with several players, recording hidden videos, and hacking at least one victim's home security cameras. The reporting consistently portrays the operation as a repeat-offender **credential theft and fraud campaign** centered on compromised Apple accounts and social-engineering of high-profile sports figures.
Jun 29, 2026
Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison after pleading guilty to a `RICO` conspiracy tied to a cybercriminal network that stole roughly **$230 million to $260 million** in cryptocurrency from victims. Prosecutors said Tangeman laundered at least **$3.5 million** between October 2023 and May 2025 for the group, which allegedly stole more than **4,100 Bitcoin** from a Washington, D.C., victim in August 2024 and used the proceeds to fund luxury homes, private jets, high-end vehicles, private security, and other lavish purchases. Authorities said the organization, identified by law enforcement as the **Social Engineering Enterprise**, targeted wealthy cryptocurrency holders using stolen and dark-web-sourced data, spoofed phone numbers, impersonation of Google and Gemini support staff, and remote-access tools including **AnyDesk** to obtain Bitcoin Core private keys. Investigators alleged the group then obscured the proceeds through mixers, exchanges, peel chains, pass-through wallets, and VPNs, while Tangeman also helped rent properties under false identities and destroy devices after arrests of key members. Another alleged launderer, **Kunal Mehta**, has also pleaded guilty and is awaiting sentencing.
Jun 29, 2026
U.S. authorities secured guilty pleas in two separate cyber-enabled criminal cases: a Ghana-based fraud ring that stole more than **$100 million** via **business email compromise (BEC)** and romance scams, and a **Phobos** ransomware administrator tied to a global extortion operation. The cases highlight parallel monetization paths—social engineering and payment redirection in BEC/romance schemes versus data encryption and extortion in ransomware-as-a-service (RaaS)—and both involve international arrests/extraditions to the United States. In the fraud case, **Derrick Van Yeboah** (40) pleaded guilty to conspiracy to commit wire fraud and agreed to pay **over $10 million** in restitution for his role in a Ghana-based operation that targeted U.S. victims from 2016 to May 2023, using spoofed emails to impersonate customers/employees and laundering proceeds through U.S. intermediaries before sending funds to coordinators in West Africa. Separately, **Evgenii Ptitsyn** (43) pleaded guilty to wire fraud conspiracy for helping develop, sell, distribute, and operate the **Phobos** ransomware platform, which the U.S. DoJ says hit **1,000+** entities and extorted **$16+ million**; he was arrested in South Korea in 2024, extradited to the U.S., and faces up to **20 years** in prison, with sentencing scheduled for July 15.
Jun 29, 2026