In a series of posts on a Telegram channel, highlighted by Warner, who is also involved in Intelligence for Good, a cybercriminal can be seen explaining to others how to run a sextortion scam. They say they tricked people into sharing nude images (they posted screenshots of the conversation) and explained ways other people can replicate them. “Hey, I’m posting your naked photos on social media and Facebook,” says a sample message that cybercriminals could use. “Not only am I posting it, but I am sending copies to your area,” the message says, before demanding $700.
While scripts like these are shared across social media channels, WIRED found at least 80 on the document-sharing service Scribd. The company removed them after WIRED contacted and a spokesperson said there are limits on what people can upload and that the company has automatic and manual reviews to remove content. “We are actively developing new capabilities to expand the scope of content moderation coverage to include a broader range of text and image violations of concern,” the spokesperson says. Some of the scripts had been online since 2020, and on the pages where they were removed, a “reading suggestions” section recommended other fraudulent scripts.
Raffile says the Yahoo Boys have been able to “thrive” online “due to the lack of moderation around all the illicit material” they share. “They are acting with impunity because they feel they will never be caught,” Raffile says.
Beyond messaging platforms, the Yahoo Boys have a presence on TikTok and YouTube. “We designed our app to be inhospitable to those who seek to exploit our community and have removed this content for violating our policies,” says a TikTok spokesperson.
“Our policies prohibit spam, scams, and other deceptive practices that take advantage of the YouTube community,” a YouTube spokesperson says. “We also prohibit videos that encourage illegal or dangerous activities. As such, we have terminated channels flagged for violating our policies and terms of service.” They add that the company removed accounts for violating policies on harmful content, spam, and generally violating its terms of service.
The accounts posted tutorials on how to scam people, link to groups on messaging apps, and promote fake video calling technology. On TikTok, several accounts include image carousels that scammers can use in their efforts to create believable personas. Some of these include posts from older women to scammers who “need pictures of grandma as proof” of their fake identities and others to scammers who “need pictures of children” for their victims.
In addition to being a threat to thousands of people around the world, Yahoo Boys can quickly adopt new technologies. David Maimon, a professor at Georgia State University and head of fraud intelligence at identity verification company SentiLink, has Yahoo Boys monitored for years and says his techniques have evolved along with new technologies.
“To establish a relationship with victims, scammers first used text messages, then began sending recorded audio messages, and now use deepfake tools to communicate with victims live,” Maimon says. “In some markets we now also see the use of cloned voices. “It is now accompanied by sending physical items to victims, such as gifts, food deliveries and flowers.” Within some groups, they use “nudification” tools to turn clothed photos of people into nude photos and deepfake video calls.
While Yahoo Boys have been active for years, all the experts we spoke to for this article say social media companies and law enforcement should treat them more seriously. “It’s time we start looking at Yahoo Boys as a dangerous organization, a transnational organized crime, and start giving it some of those labels,” Raffile says.