The $40 Spyware Loved By Stalkers and Governments 🕶 Darknet Diaries Ep. 182: Blackshades

This Darknet Diaries episode tells the story of Blackshades, a $40 remote access trojan sold openly online that gave attackers total silent control of victims' computers—reading files, logging keystrokes, and hijacking webcams—until it triggered one of the largest global cyber law enforcement operations in history 2:08-2:23, 32:35-32:52.

Key Takeaways:
• Blackshades was marketed like legitimate software (for monitoring kids or spouses) but was actually sold on hacker forums to criminals; under the law, intent matters, making both selling and unauthorized use illegal 2:28-3:09, 4:35-4:56
• The RAT ran silently, disabling webcam indicator lights, capturing passwords, messages, and banking activity, and even included a "Spreader" to infect victims' friends and a ransomware feature 6:22-7:07
• Victims were infected via social engineering—malicious links from "friends," pirated software, phishing emails, and USB sticks exploiting autorun 7:44-8:45
• Users like Stefan Rigo spied on women they knew through their webcams, while Syrian government-linked actors used it to surveillance pro-democracy activists during the civil war 13:21-14:01, 16:24-17:11
• Co-creator Michael Hogue unknowingly submitted Blackshades to an FBI-run dark web carding honeypot, providing evidence of criminal intent; Operation Card Shop led to his arrest, and he cooperated with investigators 21:35-23:07
• After Miss Teen USA Cassidy Wolf was sextorted via her webcam by a former classmate using Blackshades, the FBI used Hogue's customer list for a coordinated 2014 takedown: 97 arrests and 359 searches across 18+ countries 24:38-26:13, 28:57-30:13
• Jack's closing advice: treat the internet as hostile—cover your cameras, use encrypted storage, verify suspicious messages out-of-band, and minimize your software footprint 34:59-36:18

Though Blackshades itself is now a "museum piece," malware doesn't die—it evolves, and awareness of tools like this remains the first step in protecting yourself 33:47-34:53.

Sources:

• 2:08-2:23 Introduction to Blackshades RAT and its capabilities
• 2:28-3:09 Blackshades' legitimate-looking marketing website
• 4:35-4:56 Discussion of intent and illegality of selling to criminals
• 6:22-7:07 Stealth capabilities, Spreader feature, and ransomware
• 7:44-8:45 Social engineering and infection methods
• 13:21-14:01 Stefan Rigo's webcam spying on women
• 16:24-17:11 Syrian government surveillance of activists