A Scottish man has pleaded guilty to conspiring to hack at least a dozen US companies through text-message phishing attacks and stealing $8 million (£5.9m) in virtual currency.

The US Department of Justice (DOJ) said that Tyler Robert Buchanan, 24, from Dundee, plotted the cyber-attacks with his co-conspirators, and that the list of victims and intended victims included interactive entertainment firms, telecom providers, tech and IT companies, cloud providers, and crypto companies. 

As part of the scheme, Buchanan and his crew, allegedly part of the notorious Scattered Spider syndicate, sent hundreds of SMS phishing messages targeting the victim company’s employees, posing as the company itself or a contracted supplier.

These messages contained links to phishing websites spoofed to look like legitimate websites, and lured the recipient into providing confidential information, including account usernames and passwords.

The group also created a phishing kit that captured login credentials entered into the fraudulent websites, which were then transmitted to a Telegram channel administered by Buchanan and another co-conspirator.

According to a criminal complaint supported by the FBI, the phishing messages followed a pattern of claiming that employees’ accounts were at risk of being deactivated and urging them to log in via a linked site. Once they had entered their corporate credentials, the site sent a two-factor authentication prompt to their phone, allowing attackers to validate the login.  

The DOJ said the hackers used the stolen credentials to access employee accounts and company systems to steal confidential information, including work product, sensitive IP, and personally identifying information, such as names, email addresses, and telephone numbers.

The hackers defrauded at least a dozen companies and individual victims across the US, with Buchanan admitting in his plea agreement that he and his co-conspirators stole $8 million worth of virtual currency using information gained through the scheme.

Recommended reading

• How Scattered Spider’s Web Brought UK Retail to its Knees
• FBI and Google Mandiant Point to Scattered Spider Over Airline Cyber-attacks
• Researchers sound alarm on LAPSUS$ ‘extortion-as-a-service’

In April 2023, a text file was discovered on a device found at Buchanan’s Scottish home that contained cryptocurrency seed phrases and login information for one victim’s account, as well as the names and addresses of individual victims alongside files related to numerous companies.

Following his arrest, Buchanan, who has been in US custody since April 2025, pled guilty to conspiracy to commit wire fraud and aggravated identity theft. At a sentencing hearing scheduled for August, he faces a sentence of 22 years in federal prison.

The DOJ said that three other defendants charged with Buchanan still face criminal charges, however, another co-conspirator, Noah Michael Urban, is already serving a 10-year prison sentence and was ordered to pay $13 million in restitution.