182: Blackshades

Jack Recider introduces Black Shades, created by Alex Usol and Michael Hogue and sold online beginning in 2010. The Black Shades RAT gave attackers remote control of a computer: file access, keystroke logging, webcam and microphone activation, data locking, and credential theft. Its public website called it an affordable IT-surveillance and security product for monitoring children, spouses, or suspected cheating partners, and cited the 2004 Spy Act. Jack distinguishes legitimate monitoring, where the owner or employee knows and consents, from Black Shades’ marketing on hacker forums to people expected to abuse it. He says both selling and using it could be illegal when criminal intent and unauthorized access were proven.

Jack explains that a remote-access Trojan resembles legitimate IT support, except an unknown attacker silently controls the machine. Black Shades operators could read files, capture passwords and private messages, steal banking and social-media logins, activate cameras and microphones, and use a “spreader” to send malware through victims’ social accounts and chat apps. It also supported ransomware, allowing attackers to lock files for payment. A disclaimer made users accept responsibility and called the software educational, but Jack says the ransomware capability made its malicious purpose obvious. The real challenge was installation: victims had to be socially engineered into running what they believed was another program.

Black Shades spread through apparently trusted messages, pirated games and movies, fake photos or videos, and package-delivery alerts. Jack recalls downloading dubious games as a teenager, repeatedly reinstalling Windows after infections made his computer unusable. He also describes a Chinese laptop seller that installed a pirated Windows 11 copy containing malware that stole cryptocurrency and Steam accounts. Clean software could turn hostile after a browser extension was sold or a mobile app accepted malicious tracking code. Older Windows systems could auto-run an autorun.inf file from a USB stick, letting someone infect a computer in seconds; Black Shades users also planted drives in coffee shops and libraries.

Stefan Rigo, a 34-year-old man from Leeds, bought Black Shades for $40 with his ex-girlfriend’s credit card and infected her computer. He secretly activated her bedroom webcam without its indicator light, then became addicted to watching her and other women undress, recording screenshots and observing their messages, passwords, purchases, and banking. He spread the malware to women he knew, then to friends of those women and strangers’ laptops. He infected more than a dozen people. Jack says this voyeurism use drove substantial adoption: thousands of men used Black Shades to spy on girlfriends, ex-partners, or women they found interesting, often for blackmail or sexual gratification.

During Syria’s civil war and the Arab Spring, the Electronic Frontier Foundation and Citizen Lab documented attacks on Syrian activists. Compromised Skype accounts sent trusted-looking messages such as “there’s a person who hates you” alongside a supposed screenshot; clicking installed Black Shades. The Syrian government could then identify rally plans, inspect files and photos, and delete social-media accounts. Jack compares this with Dark Comet, an earlier RAT created by French programmer Jean-Pierre Lassure, who discontinued it partly after its use in Syria. He notes the irony that Anonymous activists supporting protesters and governments suppressing them could use similarly neutral tools for opposite purposes.

As Black Shades spread, attackers sent victims intimate webcam images and demanded Bitcoin, nude pictures, or live sexual performances, threatening to post material through their hijacked social accounts. Jack describes demands for five-minute Skype sex shows and cases where frightened women complied rather than risk exposure. He says embarrassment and fear kept victims quiet and notes, without claiming a specific Black Shades suicide, that online abuse has driven some women to despair. The malware’s hidden camera access made the abuse especially frightening: victims often did not know anyone had been watching their bedrooms, conversations, online banking, or private computer activity.

The FBI created a dark-web stolen-credit-card marketplace called Carder’s Market, posing as operators who required vendors to submit tools for testing. Hogue submitted Black Shades as a credit-card-stealing tool, unknowingly giving the FBI direct evidence that he intended to sell it to criminals. Operation Card Shop in 2012 produced 24 arrests across eight countries; Hogue was charged under the Computer Fraud and Abuse Act, cooperated, and received five years’ probation, $40,000 in forfeiture, and 500 hours of community service. The Black Shades site nevertheless stayed online, and pirated copies circulated—meaning people spying with Black Shades could themselves receive additional malware.

In 2013, high-school student Cassidy Wolfe, later Miss Teen USA, received an anonymous email containing nude images taken through her webcam. The attacker demanded more revealing material and a special performance, but Wolfe went to law enforcement instead of complying. The FBI identified him as former classmate Jared Abrahams, who had used Black Shades against at least two dozen women and girls aged 16 to their early 20s. Abrahams pleaded guilty to extortion and hacking and received 18 months in federal prison. Wolfe publicly described the experience during her Miss Teen USA year, visiting schools to warn students about webcam hacking and sextortion.

By May 2014, Black Shades had infected more than 500,000 computers in over 100 countries, generated over $350,000 in sales, and produced customer records for more than 6,000 accounts; the episode also describes its broader reach as over a million machines. Investigators spent months proving individual abuse rather than arresting everyone who bought a $40 tool, then coordinated with authorities in 18 or 19 countries. On May 19, raids produced 97 arrests and 359 searches, with more than 1,000 storage devices seized. Users were charged for voyeurism, extortion, financial theft, botnets, or ransomware. Stefan Rigo pleaded guilty, received a suspended sentence and 200 hours of community service, and entered the sex-offender registry for seven years.

Authorities arrested or charged the developers Alex Usol, Michael Hogue, and former employee Brendan Johnston, took the website offline, and dismantled the old ecosystem. Jack says Black Shades is now mostly detectable and obsolete, but malware has evolved rather than vanished. He recommends verifying suspicious messages through another channel, minimizing installed software, treating sensitive files as likely to leak, encrypting offline drives or PIN-protected USB storage, covering cameras, updating systems, using unique passwords and email addresses, and periodically running reputable antivirus scans. His broader principle is that users need not become impossible targets; they should make access difficult enough that attackers choose someone easier.