August 26, 2021

Los Angeles man, identified as Hao Kuo “David” Chi, recently pleaded guilty to four federal felonies that accuse him of stealing and sharing nude images of young women online.

The Los Angeles Times reports that according to FBI agent Anthony Bossone, Chi collected more than 620,000 private photos and 9,000 videos from an unspecified number of victims found in his Dropbox.

The FBI discovered about 4,700 iCloud credentials from 500,000 emails in two of Chi’s Gmail accounts supplied by Chi’s victims.

Chi said he selected about 200 of his victims based on online requests.

Once his “customers” had identified an iCloud account for the attack, he would use his dodgy Gmail accounts to contact the victim while posing as an Apple service representative.

In cases where the victim falls for Chi’s spearphishing attempt, Chi would then use the victim’s own iCloud credentials to log in to the service and store their photos and videos on Dropbox, after which he would provide the Dropbox link to his customers and/or conspirators.

For more information, read the original story in Ars Technica.