Microsoft device telemetry key to unmasking alleged Scattered Spider hacker

2026-07-07

FBI investigators identified 19-year-old Scattered Spider suspect Peter Stokes largely through a Microsoft global device identifier (GDID) that survived his VPN and ngrok tunneling, then cross-referenced its IP history against Snapchat, Apple, and Facebook login logs to tie him to a US$8 million ransom demand and broader conspiracy charges under the FBI's Operation Riptide.