When most people hear the term "threat actor," they imagine a criminal gang, a fraud syndicate, or an organized cyber crime operation. The Yahoo Boys are something different entirely.
Originating in Nigeria in the late 1990s, the Yahoo Boys are not a single criminal group or network. They're part of a broader online crime subculture that has spent decades normalizing and glorifying internet fraud in West Africa.
Over time, it has developed its own vocabulary, techniques, status symbols, and even influencers. And more than a quarter of a century after emerging online, it remains one of the longest-running and most resilient cyber crime subcultures in the world.
Understanding why the Yahoo Boys emerged — and why they continue to thrive — requires looking beyond cyber crime itself to a history rooted in complex societal, cultural, and geopolitical factors. That story begins in the early days of internet adoption.
Internet cafés created new opportunities
The Nigerian Oil boom of the 1970s brought unprecedented wealth to the country. Oil prices skyrocketed following the Arab-Israeli war in 1973, helping make Nigeria one of the wealthiest nations in Africa.
But when oil prices crashed in the 1980s, the economic picture changed. Suddenly, many highly educated young people found themselves facing limited job prospects and few clear paths to future financial stability.
By the late 1990s and early 2000s, internet cafés, or cyber cafés, had become popular in major commercial cities and urban centers. For many Nigerians, they created new opportunities: connecting with government services, communicating with friends and family, and accessing educational and professional resources. But they also created new opportunities for cyber criminals.
Why are they called Yahoo Boys?
At the time, "Yahoo!" was the online portal for many people connecting to the internet for the first time, and "Yahoo! Mail" was one of the most popular ways to communicate with people around the world.
)
For many people, the internet was entirely new. There was little understanding of phishing, scamming, or malicious emails because those concepts had yet to enter mainstream awareness. A small group of people in Nigeria recognized this opportunity and began experimenting with email-based scams. They often promised large sums of money through fabricated inheritance claims or other invented scenarios, provided the recipient sent an advance payment, bank account details, passport information, or other sensitive data.
"Yahoo Boys" became the common name for people sending these scam emails because many used Yahoo! email accounts. But despite the name, participation isn't limited to men. Evidence today points to the involvement of both men and women, leading some to also use the term "Yahoo Girls."
)
The rise of the "Nigerian Prince" scam
The advance fee scam is one of the best-known forms of online fraud. Often, and somewhat unfairly, referred to as the "Nigerian Prince" scam, it involves requesting an upfront payment in exchange for the promise of a much larger reward.
Early versions often claimed to involve a wealthy Nigerian prince — which is how the label stuck — but it's important to not reduce an entire scam category to one country or region. The advance fee scam blueprint is now used by many threat actors around the world.
)
Today, most people recognize the classic scam promising millions of dollars for little to no effort. But while they're widely understood now, historically, when public awareness of online fraud was still low, they will have found success.
While email-based advance fee scams appear less prominent today thanks to improved email filtering and scam protection, they haven't disappeared. Many of the social engineering techniques pioneered by these scams have continued to evolve and underpin many modern fraud campaigns.
From advance fee fraud to AI scams
Since the early days of the internet, technology has advanced considerably. Today's online scam ecosystem extends far beyond the inbox. Social media, messaging apps, cryptocurrency, and AI‑generated content have created new opportunities for scammers — and the Yahoo Boys have evolved alongside them.
In January 2025, news headlines around the world focused on the case of a French woman who believed she was in a relationship with Hollywood actor Brad Pitt. The victim reportedly lost her marriage and a significant amount of money (€830,000) before discovering that "Brad Pitt" was, in fact, part of a sophisticated deepfake scam.
Who was behind the scheme? The Yahoo Boys.
)
The Yahoo Boys demonstrate how a crime culture once associated with simple advance fee scams has evolved to embrace modern tools, techniques, and human fears.
Today, the subculture is associated not only with AI‑enhanced romance scams, but also with deeply scarring sextortion campaigns, where victims are blackmailed using intimate images they shared with someone they believed to be a trusted partner. In some cases, victims don't share explicit images at all — the photos they post online are instead used to generate AI‑created nudes, or "deepnudes."
In fact, many of the most internationally discussed and emotionally devastating scams of recent years have been linked to threat actors operating within the Yahoo Boys subculture.
How Yahoo Boys share tactics and tools
The Yahoo Boys have demonstrated their resilience over the years by adapting as platforms and defenses change. When email filters improved, they moved to social media and instant messaging apps. They use dating apps, even targeting local platforms in different countries. In one Telegram channel listing potential places to find victims, I even saw Finnish dating site Suomi24 Treffit mentioned.
)
They are also skilled at using AI. An influencer named Format Boy, for example, has shared YouTube tutorials — or "tuts" in Yahoo Boys lingo — showing how to create deepfake video call filters. Telegram channels used for Yahoo Boy research, or "updates" as they call them, list apps for generating deepnudes and other AI‑generated content. I also found a central Google Drive used to share scam template text, as well as multiple Scribd uploads.
)
This shared vocabulary matters. The Yahoo Boys refer to scam text templates as "formats." These sample messages can be copied and adapted when chatting with victims on dating apps, social media, or instant messaging apps. Throughout the rest of this article, I'll refer to these "formats" as scripts and templates.
)
Yahoo Boys playbook: the scripts behind the scams
One of the most concerning findings during my research was the extent to which Yahoo Boys share ready-made scripts for manipulating and blackmailing victims.
Many of these templates are sextortion scripts that closely mirror patterns described in victim testimonials. They typically coerce the victim into sharing an intimate image — often a mirror selfie — before escalating into threats, demands, and extortion.
)
Not all scripts follow the same sextortion narrative. I also found templates that instruct scammers to impersonate multiple authority figures, including FBI agents and Fox News representatives, who claim to have discovered compromising images of the victim. Rather than posing as a romantic partner, the scammer adopts a succession of trusted personas to create panic and pressure the victim into making payments.
)
Other templates revolve around threats of violence. Some claim that an "assassination attempt" has been ordered against the victim, and their life is in danger if they don't pay. While less frequently discussed than sextortion scams, the existence of these templates suggests that a wide range of coercive blackmail narratives are being shared and reused.
The ransom demands in these scripts typically range from $50 to $500, although scammers will just adjust the amount depending on the victim. In sextortion scams, the demands are often calibrated to what younger victims can realistically pay.
Recent reports suggest that some Yahoo Boys have set up "Hustle Kingdoms" — communities where scam techniques, scripts, and tactics are taught to newcomers. Some have also been linked to beliefs in "dark magic" and ritual practices intended to improve the chances of successful scams, including cases involving kidnapping and killing.
A scam culture that continues to evolve
The harm caused by this subculture extends beyond its victims. Many Nigerians have publicly criticized the Yahoo Boys phenomenon, arguing that it damages the reputation of their country and overshadows the millions of people who have no connection to fraud.
It's important to remember that Yahoo Boys don't represent West Africa or Nigeria. Online crime subcultures — even more organized ones — exist all over the world. The idea that you can "get rich quick" through deception and harm isn't unique to any one country.
What makes the Yahoo Boys and Yahoo Girls subculture notable isn't simply the scams they run, but its reputation and longevity. More than 25 years after emerging in internet cafés, these scammers remain active online, sharing tactics, training newcomers, adopting new technologies, and adapting to changing platforms.
That longevity is no accident. Despite stricter laws being enforced in West Africa, they still flex successful scams online. The tools have changed — from Yahoo! Mail to social media, deepfakes, and AI‑generated content — but the culture has adapted alongside them. The manipulation techniques have also evolved, growing darker over time: from promises of unexpected wealth to emotional manipulation through romance scams and, increasingly, coercion, sextortion, and blackmail.
More than anything, the Yahoo Boys show how cyber crime can persist for decades when it evolves beyond individual scammers and becomes a self-sustaining subculture.