From Phishing to Prison: A Step-by-Step Breakdown of the Scattered Spider Case

Introduction

In the summer of 2022, a wave of SMS-based phishing attacks shook the tech world, eventually leading to the downfall of a senior member of the notorious cybercrime group "Scattered Spider." This guide breaks down the exact steps that Tyler Robert Buchanan (known online as "Tylerb") took—from launching phishing campaigns to pleading guilty in a U.S. courtroom. Whether you're a cybersecurity professional, a student, or just curious about how such crimes unfold, understanding this chain of events can help you spot similar threats and appreciate the investigative work that brings criminals to justice.

What You Need (Prerequisites for Understanding This Case)

• Basic knowledge of phishing and social engineering tactics
• Familiarity with SIM swapping and cryptocurrency wallets
• Awareness of how domain registration and IP tracking work
• Context about the Scattered Spider group and their methods

Step-by-Step Breakdown

Step 1: The Phishing Campaign – Tens of Thousands of SMS Attacks

Buchanan and his accomplices launched a massive SMS phishing campaign in 2022. They sent tens of thousands of text messages designed to trick recipients into clicking malicious links. These messages impersonated trusted services, luring victims to fake login pages. Buchanan admitted to registering numerous phishing domains using the same username and email address—a mistake that later tied him to the attacks. The domains were registered less than a month before the phishing spree began, and the account logged in from an IP address in the U.K. that investigators traced back to him.

Step 2: Breaching Major Tech Companies

The phishing attacks gave the group access to employee credentials and internal systems. They successfully hacked into at least a dozen major technology companies, including Twilio, LastPass, DoorDash, and Mailchimp. Scattered Spider's hallmark tactic was social engineering—impersonating employees or contractors to deceive IT help desks into granting access. Once inside, they stole sensitive data and customer information.

Step 3: SIM Swapping to Steal Cryptocurrency

Using the data stolen from tech companies, the group launched SIM-swapping attacks. In a SIM swap, the fraudster transfers the victim's phone number to a device they control. This allows them to intercept SMS-based authentication codes and password reset links. Buchanan admitted to stealing at least $8 million in virtual currency from individual cryptocurrency investors across the United States. The U.S. Justice Department confirmed the group used this method to drain funds from victims' wallets.

Step 4: The Investigation and International Chase

The FBI traced the phishing domains back to Buchanan after discovering that the account used to register them logged in from a U.K. IP address leased to him throughout 2022. Investigators collaborated with Scottish police. Meanwhile, Buchanan fled the U.K. in February 2023 after a rival cybercrime gang attacked his home, assaulted his mother, and threatened him with a blowtorch to steal his cryptocurrency keys. He was eventually detained by airport authorities in Spain. Photos published by the Daily Mail show him being arrested—a stark contrast to his former hacker handle "Tylerb," which once topped leaderboards in the criminal hacking scene.

Step 5: Guilty Plea and Consequences

In 2025, Buchanan pleaded guilty to wire fraud conspiracy and aggravated identity theft. He now faces the possibility of more than 20 years in prison. His case serves as a high-profile example of how international cooperation and digital forensics can dismantle even the most sophisticated cybercrime rings.

Tips and Lessons Learned

• Enable multi-factor authentication using authenticator apps, not SMS—SIM swapping can bypass text-based codes.
• Be suspicious of unsolicited text messages that urge you to click a link, even if they appear to come from a trusted source.
• Use a password manager and unique passwords for each account to limit damage from a data breach.
• Monitor your cryptocurrency accounts for unauthorized transactions and consider using hardware wallets.
• Companies should implement strong identity verification for help desk calls and train staff to spot social engineering.
• Law enforcement agencies can benefit from sharing threat intelligence across borders, as seen in the FBI's collaboration with Scotland and Spain.

By understanding each step of Buchanan's operation and capture, you can better protect yourself and your organization from similar threats. The Scattered Spider case is a cautionary tale: even the most clever cybercriminals leave digital footprints that eventually lead to their arrest.