From Gaming Account Takeovers to SIM Swapping: Conor Freeman’s Story

Summary

Conor Freeman describes stealing social media accounts using breached credentials and explains how attackers use social engineering to hijack phone numbers through SIM swaps.

Key points

• Freeman describes how a Minecraft server administrator was persuaded to reveal security-question answers, enabling a password reset and server deletion.
• He says he searched breached databases for account holders’ credentials and used reused passwords to take over social media accounts for resale.
• Freeman estimates that most accounts traded on OGUsers were stolen; the estimate is his own and is not independently verified in the transcript.
• He describes SIM swapping through calls to mobile carriers using victims’ personal information to impersonate them and transfer their phone numbers.
• A hijacked phone number can let an attacker receive account-recovery codes and potentially reset additional accounts linked to the victim’s email.
• Freeman also describes refund scams, stolen loyalty-point accounts and scripts used to guess promotional membership codes.

MITRE ATT&CK

Related Articles

• Red Canary’s 2026 Threat Detection Report Highlights Surge in Identity Threat Detectionsgithub.com/jacobdjwilsonT1110.004
• HUMAN’s 2026 Report Finds Surging AI Traffic and Post-Login Compromise Attemptsgithub.com/jacobdjwilsonT1110.004
• ITRC Reports 1,803 Data Compromises and 471.2 Million Victim Notices in H1 2026github.com/jacobdjwilsonT1110.004
• Delinea’s 2026 Report Finds AI Identity Security Confidence Outpaces Governancegithub.com/jacobdjwilsonT1110.004
• Cloudflare 2026 Threat Report Highlights Identity Abuse and Record DDoS Attacksgithub.com/jacobdjwilsonT1110.004