Jail for RSAF regular who targeted victims in phishing attacks to access their intimate images

SINGAPORE – A man targeted at least 22 victims in phishing attacks over the course of two years to access multiple women’s intimate images on their social media or cloud storage accounts for his own sexual gratification.

On May 15, K Eshwaran, 26, was sentenced to 11 months’ jail for his crimes. A Republic of Singapore Air Force regular, he has been suspended from all work-related duties. 

Between January 2019 and November 2021, he used an illicit website providing phishing services to gain access to his victims’ accounts, where he searched for compromising images.

The prosecution said that, in several instances, he even reached out to the victims’ contacts by posing as the victims. He then asked these contacts for intimate images.

Multiple victims alerted the police and Eshwaran was caught.

He was released on bail but continued to commit a similar offence, targeting a woman in a phishing attack in January 2023 while he was under investigation.

He pleaded guilty to 10 charges under the Computer Misuse Act, including making unauthorised access to his victims’ social media accounts.

Twenty-one other charges were considered during sentencing.

In 2019, Eshwaran registered for an account on a website that would gain him unauthorised access to other people’s social media accounts.

He then targeted multiple people he knew in real life, sending them phishing links generated through the website that he tricked them into clicking.

Deputy Public Prosecutors Matthew Choo and Joshua Phang said in court documents: “The accused told victims that their intimate images had been posted onto social media sites.

“The accused then sent a phishing link to the victims, telling them that the link would direct them to the page where their intimate images are posted.

“This phishing link then brought the victim to a simulated login page.”

To reinforce his cover story, Eshwaran also sent his victims a screenshot of either an image of a woman with a sexually charged caption or a screenshot of the victims themselves.

His victims were directed to a simulated login page for various social media sites after they clicked on the malicious links.

Login credentials they entered on the phishing page were captured by the website, and Eshwaran could then access them via a page on the portal titled “My Victims”.

The DPPs said Eshwaran also used a “hacking method” to target some of his victims.

He entered e-mail addresses linked to his victims’ social media accounts into the illicit website, which generated a list of possible login credentials for these accounts.

Via trial and error, he used this list of login credentials to access the victims’ social media accounts.

After obtaining the victims’ login credentials by either method, he would trawl through their accounts to see if any intimate images were stored on them.

In some instances, Eshwaran impersonated the social media account holders to ask their online contacts for intimate images. He targeted people he thought might have an intimate relationship with the account users.

One of his victims was a 24-year-old woman whom he sent a phishing link to on or around Jan 29, 2019, to obtain the login credentials to her Facebook account.

He also pretended to be the woman to send messages to six of her contacts. Three of them responded but did not provide any images.

They eventually informed the woman of their suspicion that her account might have been hacked, and she alerted the police in May 2019.

Eshwaran’s bail was set at $18,000 on May 15, and he is expected to surrender himself at the State Courts on June 19 to begin serving his sentence.

In a statement, the Ministry of Defence said: “The Singapore Armed Forces (SAF) holds its service personnel to high standards of discipline and integrity. Service personnel who commit offences will be dealt with in accordance with the law.

“The SAF will initiate further actions upon the conclusion of court proceedings, which may include discharging him from service.”