Illinois Man Pleads Guilty to Phishing 4,500 Snapchat Users to Steal Private Photos

An Illinois man has pleaded guilty to a phishing and account-compromise scheme that targeted thousands of Snapchat users, leading to the theft of private images from numerous women.

Federal prosecutors stated that Kyle Svara, 27, of Oswego, Illinois, admitted to charges including aggravated identity theft, wire fraud, computer fraud, conspiracy to commit computer fraud, and making false statements related to child sexual abuse material. U.S. District Judge Brian E. Murphy has scheduled sentencing for May 18, 2026.

Illinois Man Pleads Guilty

From at least May 2020 through February 2021, Svara allegedly conducted a targeted social engineering campaign against Snapchat users.

He collected victims’ email addresses, telephone numbers, and Snapchat usernames. Then he initiated account-access or password-recovery processes that prompted Snap Inc. to send legitimate security codes to the users.

Svara used anonymized telephone numbers to impersonate a representative from Snap Inc., sending text messages that requested the security codes.

This method relied on a common phishing tactic: attackers do not need to bypass the platform’s authentication controls directly if they can persuade a victim to disclose a valid, time-sensitive verification code.

Authorities reported that Svara texted more than 4,500 people as part of the operation. Approximately 570 women provided their Snapchat access codes, granting him unauthorized access to at least 595 accounts.

Once inside, he downloaded nude or semi-nude images and subsequently retained, sold, or traded the stolen content through internet forums and private transactions.

Prosecutors also indicated that Svara advertised his services online, including by making posts on Reddit claiming he could “get into girls’ Snap accounts” to obtain content for buyers or trading partners.

The case highlights how account-recovery features, while essential for legitimate users, can become prime targets for social engineers looking to hijack accounts protected by SMS-based verification.

This activity is linked to Steve Waithe, a former track and field coach at Northeastern University, who allegedly hired and paid Svara to compromise Snapchat accounts belonging to women he coached or knew.

Waithe was convicted in November 2023 on charges of wire fraud, cyberstalking, computer fraud, and conspiracy, and was sentenced in March 2024 to five years in prison, followed by three years of supervised release.

In addition to targeting accounts associated with Waithe, Svara reportedly went after women in and around Plainfield, Illinois, as well as students at Colby College in Waterville, Maine.

During an interview with investigators, Svara allegedly denied any involvement in Snapchat hacking and claimed he did not seek or access child sexual abuse material.

However, investigators determined that he had collected, distributed, and solicited such material, according to the U.S. Attorney’s Office for the District of Massachusetts.

The FBI has urged potential victims or individuals with relevant information to submit a report through its victim-assistance form at forms.fbi.gov/victims/snaphackvictims.

This case underscores the importance of users never sharing one-time security codes, even with someone claiming to represent a technology platform.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.