Phone company

Two SIM card swappers phished a phone company to steal $16,000 in crypto

Kyell Bryan, 20, of Pennsylvania, pleaded guilty to aggravated identity theft for a SIM card swapping scheme and theft of cryptocurrency, according to the United States Attorney’s Office for the District of Maryland.

According to the original indictment, in June 2019, Bryan, who was 19, conspired with Jordan K. Milleson, then 21, and others. The group engaged in phishing and vishing (voice phishing) to trick employees of an anonymous wireless carrier into spitting out their login credentials.

Like Brian Krebs reported When Bryan and Milleson were indicted, they were active participants in the OGUsers business forum, which spawned similar phishing attacks on Twitter and others, usually with the goal of stealing and trading social media credentials. Leaked posts from OGUsers reveal that in 2019, Bryan asked another member to help him create a site that would look like the T-Mobile employee login page.

They used those credentials to perform unauthorized SIM swaps, redirecting their target’s phone number to bypass the two-factor authentication process that was supposed to protect the accounts. SIM-swapping attacks are the reason AT&T faced a now-dismissed lawsuit alleging negligence for not shutting them down in 2018, and the method opened up a way to temporarily hijack the CEO’s handle of Twitter, Jack Dorsey, in 2019.

According to prosecutors, after making the exchange, Bryan instructed Milleson to transfer cryptocurrency worth $16,847.47 to the victim’s account.

The intriguing partnership turned into a mission to find Milleson’s true identity when Bryan and other accomplices suspected Milleson of deceiving them. After finding out his aliases and personal information from another accomplice, Bryan attempted to “crush” him at his home.

Bryan called Baltimore County police, saying he was at Milleson’s home address with a handgun, saying he had shot his father, and threatening to kill himself. During the call, he threatened to shoot if confronted by police, attempting to set up the kind of dangerous encounter that has already killed some victims.

BCPD did not find a shooter at the home, but officers spoke to Milleson’s relative, who told them about an earlier phone call claiming Milleson stole $20,000.

Milleson was sentenced to two years in federal prison and ordered to pay restitution of $34,329.01 in May.

Bryan is expected to be sentenced in January 2022 and faces two years in federal prison after a year on probation. As part of his plea deal, Bryan will be ordered to pay $16,847.47 in restitution.