Loading story…
The U.S. Attorney’s Office for the Southern District of New York said Kamerin Stokes, also known as "TheMFNPlug," was sentenced to 30 months in prison for his role in a credential stuffing scheme that compromised user accounts at a fantasy sports and betting platform identified in news coverage as DraftKings. Prosecutors said the attack began around November 18, 2022, using stolen credentials from other breaches to gain access to about 60,000 accounts, enabling theft from customer balances and causing losses of hundreds of thousands of dollars.
Authorities said Stokes bought compromised betting accounts in bulk and operated an online "Shop" that sold access to stolen accounts, with victim accounts listed at more than $125,000 in total value. After pleading guilty on April 25, 2024, to conspiracy to commit computer intrusion, he allegedly reopened the shop, promoted it with the slogan "fraud is fun," and said he did so in part to pay his attorneys, leading to his rearrest for violating pretrial release conditions. In addition to prison, the court imposed three years of supervised release, forfeiture of $125,965.53, and restitution of $1,327,061.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
On April 16, 2026, the U.S. Attorney's Office for the Southern District of New York announced that Stokes was sentenced to 30 months in prison. He also received three years of supervised release, forfeiture of $125,965.53, and restitution of $1,327,061.
After his guilty plea, Stokes reopened his online shop, advertised it with the slogan "fraud is fun," and said he did so in part to pay his attorneys. He was subsequently rearrested for violating the conditions of his pretrial release.
On April 25, 2024, Kamerin Stokes, also known as "TheMFNPlug," pleaded guilty to conspiracy to commit computer intrusion for his role in the account-hacking and resale scheme. Prosecutors said he bought compromised betting accounts in bulk and operated a shop selling access to stolen accounts.
Around November 18, 2022, a credential stuffing attack targeted a fantasy sports and betting website reportedly identified in news coverage as DraftKings. Using stolen credentials from other breaches, the scheme successfully accessed about 60,000 user accounts and caused losses of hundreds of thousands of dollars to users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcejustice.gov
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nathan Austad, a 21-year-old Minnesota man who used the alias **"Snoopy"**, was sentenced to 18 months in prison for his role in the 2022 credential-stuffing attack that compromised DraftKings customer accounts. U.S. prosecutors said Austad pleaded guilty to conspiracy to commit computer intrusion and admitted participating in a scheme that used usernames and passwords from other breaches to access DraftKings accounts protected by weak or reused credentials. He was also sentenced to three years of supervised release and ordered to pay roughly **$1.8 million** in restitution and forfeiture. Authorities said the group compromised about **60,000** accounts, while DraftKings previously disclosed that **67,995** customer accounts were affected. The attackers added payment methods they controlled to roughly **1,600** accounts, stole about **$600,000**, and sold access to compromised accounts through online marketplaces including **Goat Shop** and Austad’s own Snoopy-branded site. Investigators also traced about **$465,000** in cryptocurrency tied to Austad, and his sentencing makes him the third defendant convicted in the case after Joseph Garrison and Kamerin Stokes received prison terms.
Jun 29, 2026
U.S. prosecutors have charged 19-year-old dual U.S.-Estonian citizen Peter Stokes, allegedly a member of the **Scattered Spider** cybercrime group who used the alias `Bouquet`, after his arrest in Finland on April 10. According to reports citing court records, Stokes was detained while allegedly attempting to board a flight to Tokyo and now faces wire fraud, conspiracy, and computer intrusion charges in a sealed six-count complaint, with U.S. authorities seeking his extradition to Chicago. Investigators allege he took part in at least four intrusions, including a 2023 breach of an online communications platform and other attacks carried out while he was still a teenager. The complaint links Stokes to Scattered Spider operations that relied on help-desk social engineering, credential resets, MFA fatigue, and SMS phishing to gain access to major corporate environments. One 2025 intrusion described in the filings allegedly targeted a multibillion-dollar luxury retailer, where attackers obtained administrator access, claimed to have stolen **100 GB** of data, and issued an **$8 million** extortion demand, causing more than **$2 million** in losses. The case adds to broader law-enforcement pressure on the financially motivated group, also tracked as **Octo Tempest**, which has been tied to intrusions affecting MGM Resorts, Caesars, Twilio, Reddit, Riot Games, Mailchimp, DoorDash, Harrods, Marks & Spencer, WestJet, and Jaguar Land Rover.
Jul 3, 2026
U.S. prosecutors charged 19-year-old dual U.S.-Estonian citizen Peter Stokes over an alleged **Scattered Spider** intrusion in which attackers socially engineered a luxury retailer’s IT help desk, reset credentials and MFA, accessed privileged accounts, stole data, and attempted to extort the company for **$8 million** in cryptocurrency. Court filings say the May 2025 attack caused roughly **$2 million** in operational losses even though the victim restored access without paying, and investigators say at least **77 GB** of data was exfiltrated during the breach. Authorities said Microsoft telemetry played a central role in identifying Stokes, with a persistent Windows **Global Device Identifier** (`GDID`) tying activity from the intrusion to his device and online accounts. Investigators also linked infrastructure used in the attack, including **ngrok** tunneling and a **Tzulo**-hosted VPN proxy, before correlating the same identifier with accounts on Apple, Snapchat, Facebook, and Ubisoft/Growtopia across locations including Estonia, New York, and Thailand. Stokes was arrested in Finland while attempting to board a flight to Japan, extradited to the United States, and now faces federal charges including conspiracy, computer intrusion, wire fraud, and violations of the **Computer Fraud and Abuse Act**.
Jul 12, 2026