A Nigerian national named Charles Onus has pled guilty in the District Court of the Southern District of New York to hacking into a payroll company's user accounts and stealing payroll deposits.

According to the indictment and the statements made in court, Onus was actively involved in a scheme that took over user accounts of company employees across the United States and stole payroll deposits by diverting the salary payments to debit cards under his control.

This malicious activity started in July 2017, and until the time of his arrest, Onus had compromised 5,500 user accounts to divert a total of $800,000 in payroll funds.

Exploiting a hole in account security
The threat actor used credential stuffing attacks to gain access to accounts at a human resources and payroll company responsible for making salary payments for other company's employees.

Credential stuffing is a type of cyberattack where threat actors use username and password combinations taken from previous data breaches and attempt to use those credentials to log in at other online sites.

The method is different from brute-forcing or guessing the passwords, as it doesn't involve cracking but instead relies on the victim reusing the same credentials on multiple platforms.

"After a Company user account was compromised, the bank account information designated by the user of the account was changed so that Onus would receive the user's payroll to a prepaid debit card that was under Onus' control," details the DOJ announcement.

The arrest of Charles Onus came on April 14, 2021, when the defendant flew from Abuja, Nigeria, to San Francisco, where he was arrested at the airport.

The defendant has now pled guilty to one count of computer fraud for accessing foreign computer networks without authorization. This carries a maximum sentence of five years in prison, and the actual punishment is to be decided by Judge Gardephe on May 12, 2022.

https://www.bleepingcomputer.com/news/security/nigerian-hacker-pleads-guilty-to-stealing-payroll-deposits/

Charles Onus

Name Checkers Association of Nigeria are confused

Kudos.Show them that we are not that dull.

maximum sentence of five years in prison for $800,000?

[img]https://media./images/fb9a10aa60d5b694b35a09dc008eaf41/tenor.gif[/img]

NwaNimo1:
maximum sentence of five years in prison for $800,000?

That sentence of 5 years is still high especially after all he will still lose all he has ever worked for and he will still be deported after being most likely sodomized in the prison.

Some folks like him eventually die some few years after their deportation , making some conspiracy theorists to suggest that they may have been poisoned with slow release/fatal substances just to reduce the likelihood of them getting back into the system.

The Judge ain't stupid or naive with that 5 year sentence since he is a foreigner. They can not keep using their taxpayers money to keep fairing for him for too long since he is not an Alqaeda or Isil terrorist as a security asset for more intelligence.

He is a goner and it is truly a horrible place he placed himself because of greed, wrong company, laziness and lack of self discipline .

I hope others who are enticed by unexplained wealth can learn from his eventual conviction.
Stay off crime, crime does not pay.