Webcam blackmail: the real cases behind "Shut Up and Dance"

If you searched for "someone hacked my webcam" because a message arrived, or because a camera light came on when it should not have, start with this: what you are feeling has a name, it has happened to many people, and there are concrete steps that work. Nothing here requires you to have done anything wrong. The people in the cases below were targeted because they owned a computer with a camera, which is nearly everyone.

"Shut Up and Dance" is a 2016 episode of the television series Black Mirror, and many readers arrive here because of it. The episode is fiction. Everything below comes from court filings, government agencies, news organisations and published research.

Cassidy Wolf and the Temecula case

In March 2014 a federal judge in Santa Ana, California, sentenced a 20-year-old college student named Jared James Abrahams to 18 months in prison. According to the Justice Department, he had broken into as many as 150 online accounts, taking over email, social media and, in some cases, the victims' computers themselves. With that access he could switch on a webcam from a distance and, at times, photograph a victim undressed.

Reuters reported that one of the people he targeted was Cassidy Wolf, who had been his classmate at a Temecula high school and who went on to be crowned Miss Teen USA 2013. She came forward to say she was a victim. The BBC reported that more than two dozen women in the United States, Ireland and other countries had their computers hacked by him over about two years.

The blackmail followed a pattern. The Justice Department said he threatened to post the pictures on his victims' social media accounts unless they sent more nude photos or video, or joined a Skype session and did what he said for five minutes. Several teenagers and women in their early twenties had pictures posted. At least two agreed to the Skype sessions in an attempt to keep their photos off the internet. Reuters reported that the criminal complaint listed 12 girls, at least one as young as 16, and that prosecutors said he had also entered the computers of some 100 to 150 other people.

A remote-access trojan built to stay hidden: the Mijangos case

The Brookings Institution published a long study of this crime in 2016 and opened it with the case of Luis Mijangos of Santa Ana, California. Its authors, drawing on court documents, describe a man who tricked scores of women and teenage girls into installing malicious software. That software gave him access to every file, photo and video on the infected machines. It also let him see everything typed on the keyboard and switch on any attached camera and microphone at will, so he could watch, listen and record without the victim knowing.

He used a keylogger to check whether victims had told friends, family or the police, and if they had, he threatened them again. In some cases he posed as a victim's boyfriend to talk her into creating intimate images. He also used infected computers to message the victims' contacts, which spread the software further. Brookings reports that he told federal authorities he designed it to evade antivirus programs.

Investigators found more than 15,000 webcam captures, 900 audio recordings and 13,000 screen captures on his computers, with files tied to 129 computers and roughly 230 people, 44 of them minors. The FBI arrested him in June 2010. He pleaded guilty to one count of computer hacking and one of wiretapping and was sentenced to six years in prison.

Blackshades: how a $40 tool reached half a million computers

Mijangos wrote his own software. Most people who spy through a webcam do not. In May 2014 the FBI and law enforcement in 18 other countries announced a takedown of the people behind a remote-access tool called Blackshades. The FBI said the software had been sold to thousands of buyers in more than 100 countries and used to infect more than half a million computers. More than 90 arrests had been made at that point, over 300 searches carried out and more than 1,900 domains used to control victims' computers seized.

The FBI's own description of what the tool could do is blunt: steal passwords and banking credentials, hack into social media accounts, access documents and photos, record every keystroke, activate webcams, hold a computer for ransom and use it in attacks on other systems. The popular version cost as little as $40, and buyers could customise it. The Guardian noted that installing it on someone's computer without their knowledge is against the law in most countries.

How a remote-access trojan switches on a camera

A remote-access trojan, usually shortened to RAT, is a program that gives someone else the same control over your device that you have. It runs quietly in the background. It reports back to a server the attacker controls, and the attacker then sends it commands. One of the commands is simply "turn on the camera and send me what it sees."

The cases above show how it gets onto a device. Victims were tricked into running a file, or opened an attachment, or received a message that seemed to come from a friend whose own computer was already infected. The FBI's advice after the Blackshades takedown points at exactly these routes: do not open attachments in unsolicited email, even from people in your contact list, do not click links in email, and download software only from sites you know and trust.

How the blackmail is run

There are two quite different crimes that get lumped together as webcam blackmail, and it helps to know which one you are facing.

The first is the one in the cases above: the attacker takes control of your device, collects images or recordings, and demands more material or money. Here the pictures are real and were taken without consent. The demand might arrive by email, direct message or in a note on your own screen.

The second does not need a RAT at all. The UK National Crime Agency describes financially motivated sexual extortion as usually carried out by organised criminal gangs, often based overseas. The contact comes from a fake or hacked account. The conversation turns sexual quickly. The person is pressured into sending images or appearing on camera, then told the pictures will be sent to their family and friends unless they pay. The agency says teenage boys aged 14 to 17 and men aged 18 to 30 are particularly at risk, though anyone can be targeted. It also notes that offenders sometimes tell a person they have been hacked and have access to their images and contacts whether or not that is true.

The Northern Ireland case of Ronan Hughes shows how harmful the second type can be. The Independent reported that Ronan, a 17-year-old from County Tyrone, was contacted in June 2015 by someone posing as a girl and was tricked into sharing intimate photographs. His family remembered him as a happy-go-lucky teenager. Europol said the Police Service of Northern Ireland, Romanian police, Europol and the NCA investigated together, and that a 31-year-old Romanian man was sentenced to four years in Timisoara for blackmail and for producing and distributing indecent pictures of a child. This article does not go into what happened to Ronan afterwards. What matters is that a young person being blackmailed is in a situation that adults and police can help with, that it can be survived, and that no single event has to define a life.

Europol's guidance for people being threatened says offenders can be "very clever at making you feel guilty" to stop victims from getting help. That guilt is the tool.

When someone has watched you, the fear tends to move off the screen and into the body, so that an ordinary room or an ordinary laptop starts to feel unsafe.

What victims described

Brookings, quoting the Mijangos prosecution, reports that some of his victims "thoroughly feared him and continued to be traumatized." One said she felt terrorized and did not leave her dorm room for a week. Others listed trouble concentrating, changes in appetite, more stress at school and at home, a lack of trust in other people, and a wish to be alone. At least one kept a lasting fear that her attacker would return.

Research on people who experienced online sexual abuse as young people points the same way. A 2023 qualitative study in Frontiers in Psychology, by Felipa Schmidt, Filippo Varese and Sandra Bucci, interviewed eight women aged 18 to 28. It found shame and self-blame about having sent images, and ongoing fear about who might have pictures of them. One participant said she was "paranoid about like who's got pictures of me, like who's looking at me." Another, looking back, said "it wasn't my fault." It is a small study, but its findings match the court records.

The fear usually eases once the situation is under control: the account is secured, the device is clean, the report is made, the threats have stopped working. Many people find it helps to have one trusted person who knows. Secrecy is what the blackmailer depends on, and telling someone removes much of it.

If it is happening to you: first steps

These steps follow the guidance of the UK National Crime Agency and Europol, and they apply to adults and teenagers alike.

1. Stop replying. Do not send more, and do not pay. The NCA warns there is no guarantee that paying stops the threats, and once you have shown you can pay they are likely to ask for more. If you have already paid, do not pay again.
2. Keep the evidence. Do not delete messages, images or bank details. The NCA suggests deactivating social media accounts rather than deleting them so that data can be retrieved. Note down usernames, links and dates.
3. Block the person on every platform after you have saved what you need.
4. Tell someone you trust. If you are under 18, speak to a trusted adult.
5. Report it. Details are in the reporting section below.
6. Secure your accounts and check your device, using the steps further down.

The table below pairs common warning signs with the sensible response. It is a guide, not a diagnosis.

What you notice	What it may mean	What to do
Email says "I hacked your webcam" and quotes an old password	Often a bulk scam using a password from an old data breach	Do not reply or pay. Change that password anywhere you still use it. Run a malware scan.
Message includes a real image from your camera	Your device may have been accessed	Disconnect from the internet, save the message, scan the device, change passwords from a different device, report it.
Camera light comes on when you are not using the camera	An app or website is using the camera, possibly a RAT	Check which apps have camera access, run an offline scan, cover the camera meanwhile.
A stranger quickly turns the chat sexual and asks you to move to another app	Typical of financially motivated sexual extortion	End the chat, block, keep the evidence, report. No RAT is involved.

How to check a Windows PC for a remote-access trojan

No check is perfect, and a skilled attacker may hide well. The aim is to look for obvious signs and to remove the most common infections. If the threat is serious, treat the device as untrusted and use another device for your passwords.

1. Disconnect from the internet. Switch off Wi-Fi or unplug the cable. A RAT cannot receive commands while the device is offline.
2. Open Windows Security, then Virus and threat protection, then Scan options. Microsoft describes the Microsoft Defender Antivirus (offline) scan as running after a restart without loading Windows, which makes it harder for persistent malware to hide. It restarts the PC, so save your work first.
3. Open Settings, then Privacy and security, then Camera. Microsoft lists which Microsoft Store apps may use the camera and gives a separate switch called "Let desktop apps access your camera." Desktop apps cannot be switched off one by one, and a RAT is a desktop program. Turning that switch off stops ordinary desktop apps from using the camera, including your browser and video-call app, until you turn it back on. Treat it as a temporary measure and not as protection against malware.
4. Open Settings, then Apps, then Installed apps, and look for programs you do not recognise. Search the exact name before removing anything.
5. After a scan comes back clean, update Windows, change the password for your email first and then for other accounts, and turn on two-step verification everywhere it is offered.
6. If the problem returns, or you shared sensitive material, back up your documents and reinstall Windows. Take advice from the police or a trusted technician before you wipe the device if you may need it as evidence.

How to check a phone

Phones make this easier because the operating system tells you when the camera is in use.

• iPhone: go to Settings, then Privacy and Security, then Camera. The list shows every app that has asked for access, and you can switch any of them off. Apple says that whenever an app uses the camera a green indicator appears, and an orange one appears when an app uses the microphone alone. Control Center also shows when an app has recently used either.
• Android: swipe down from the top of the screen when the green indicator appears in the top-right corner. Google says you can tap it once to see which app is using the camera or microphone and tap again to manage permissions. To switch camera access off for the whole phone, go to Settings, then Security and privacy, then Privacy, then Privacy controls, and turn off Camera access. Android also offers a privacy dashboard in Settings that shows which apps used which permissions and when.

The practical check on a phone is permissions, indicators and removing suspicious apps. If you believe a phone is compromised, saving your evidence and then doing a factory reset is the stronger step.

Camera permissions and covers

The Justice Department's own advice at the end of the Abrahams sentencing release was to cover your webcam when you are not using it. A sliding shutter or a small piece of opaque tape costs almost nothing. It will not stop a microphone from working, but it keeps the camera from seeing you.

On a Mac, open the Apple menu, then System Settings, then Privacy and Security, then Camera, and switch off every app you do not need. Apple notes that apps you have installed which have asked to use the camera appear there, and in Safari you can control which websites may use the camera.

Where to report

• United States: the FBI at tips.fbi.gov or ic3.gov, the Internet Crime Complaint Center. If an account or identity has been stolen, identitytheft.gov. If you are under 18, or the images are of a minor, takeitdown.ncmec.org helps remove or stop the spread of pictures and videos.
• For adults anywhere: stopncii.org, a free tool that helps detect and remove intimate images from being shared online.
• United Kingdom: call 101, or 999 in an emergency. Report fraud and cyber crime at reportfraud.police.uk, the service many people still know as Action Fraud (actionfraud.police.uk), or on 0300 123 2040. Under-18s can use the CEOP Safety Centre, and the NCA also points to Childline's Report Remove tool.
• Europe: contact your national police. Europol's Say No campaign lists reporting channels for each country.
• Also report the account to the platform where the contact happened.

How to lower the risk

The FBI's advice after the Blackshades takedown still holds: keep antivirus software and your system updated, use a different strong password for each account, and download software only from sources you trust. Add two-step verification, and set social media accounts to private, as the NCA recommends.

If you are a parent, the NCA recommends frequent, open and non-judgemental conversations about relationships, sex and being online, so that a child knows they can come to you without fear of punishment. A child who expects anger will hide the problem.

If you need to talk to someone now

If you feel overwhelmed, hopeless or unsafe, please talk to someone today. In the United States, call or text 988, the 988 Suicide and Crisis Lifeline. In the UK and Ireland, call Samaritans free on 116 123. If you are in immediate danger, call your local emergency number.

The NCA says that if you have been tricked or deceived, it is not your fault, and the most important thing is to get help. Being blackmailed is a crime committed against you. It can pass, and people do recover.

Frequently asked questions

Can someone hack your webcam?

Yes. Court records and the FBI describe cases in which remote-access software was used to switch on webcams without the owner knowing. Most people are never targeted this way, but it is real, and simple steps such as keeping software updated, not opening unexpected attachments and covering the camera reduce the risk.

How do I know if my laptop camera is hacked?

Warning signs include the camera light coming on when you are not using it, an app you do not recognise using the camera, strange messages sent from your accounts, or a message containing a picture taken from your camera. Run a full offline scan with Microsoft Defender or your antivirus, and check which apps have camera permission.

Someone hacked my webcam and is threatening me. What do I do?

Do not pay and do not send anything more. Keep the messages as evidence, block the sender, disconnect the device from the internet and scan it, then report to the police. In the US use tips.fbi.gov or ic3.gov, and in the UK call 101. Tell someone you trust.

Is a webcam blackmail email real if it shows my password?

Often not. Many such emails are sent in bulk, using passwords from old data breaches, and only claim to have a recording. Change that password wherever you still use it and do not reply or pay. If the message includes a real image from your camera, treat the device as compromised and follow the steps above.

Does covering my webcam really help?

Yes, for the camera. The Justice Department advised covering webcams when they are not in use. A cover will not stop a microphone or screen capture, so it works best alongside updates, strong passwords and careful attachment habits.

Should I pay a webcam blackmailer?

No. The UK National Crime Agency warns there is no guarantee that paying stops the threats and that offenders usually ask for more once you have shown you can pay. Europol gives the same advice. If you have already paid, do not pay again and report it.

Who gets targeted by webcam blackmail?

Anyone can be. The NCA says teenage boys aged 14 to 17 and men aged 18 to 30 are particularly at risk of financially motivated sexual extortion, while cases involving hacked webcams, such as those of Abrahams and Mijangos, mostly involved women and girls.