Zachary Shames Pleads Guilty to Keylogger Scheme

ALEXANDRIA, Va. — A 21-year-old college student turned hacker for profit. Zachary Shames of Great Falls, Virginia, pleaded guilty today to aiding and abetting computer intrusions, admitting he built and sold malicious software designed to steal passwords, banking details, and other sensitive data from unsuspecting victims.

Shames developed a keylogger — a type of spyware that records every keystroke on an infected machine — while still in high school in Northern Virginia. By the time he moved into his college dorm room, he had refined the malware into a commercial-grade weapon. Federal prosecutors say he sold access to more than 3,000 users worldwide, who together infected over 16,000 computers with his software.

The malware, capable of bypassing antivirus protections and silently harvesting login credentials, was marketed on underground forums. Shames didn’t pull the trigger on every hack, but he supplied the gun. Prosecutors argue his role was central to a sprawling cybercrime network that exploited victims across continents, from individual bank accounts to corporate systems.

Shames now faces a maximum penalty of 10 years in federal prison. U.S. District Judge Liam O’Grady accepted the plea in the Eastern District of Virginia. The statutory maximum is set by Congress, but actual sentencing will hinge on federal guidelines and aggravating factors, including the scale of the breaches and Shames’ prolonged involvement in the scheme.

The case was announced by Dana J. Boente, U.S. Attorney for the Eastern District of Virginia, and Paul Abbate, Assistant Director in Charge of the FBI’s Washington Field Office. Prosecution is led by Assistant U.S. Attorney Kellen S. Dwyer and Senior Counsel Ryan K. Dickey of the Department of Justice’s Computer Crime and Intellectual Property Section.

Court records, including the statement of facts filed with the plea agreement, are available through the U.S. District Court for the Eastern District of Virginia or via PACER under Case No. 1:16-CR-289. The full press release is posted on the U.S. Attorney’s Office website.