CSIDB logo
Threat actor

theinfidel

Attribution profile

Type
Activist
Location
United Kingdom
Known incidents
1 incident
Sources
1 source
First seen
2014-02-17
Last seen
2014-02-17
Updated
2026-08-01 02:37
Aliases
1 alias

STIX characteristics

Threat actor characteristics are available to members.

Profile narrative

The threat actor known as theinfidel, also operating under the Twitter handle @th3inf1d3l, is based in the United Kingdom. This alias has been associated with a series of data‑leak incidents targeting online platforms, most notably a breach of a UK‑based Islamic community site in February 2014. The actor’s public statements and the nature of the leaked material indicate a pattern of ideologically driven activity rather than financially motivated crime.

In the 2014 incident theinfidel compromised muslimdirectory.co.uk, extracting 38 903 user records that included email addresses, plaintext passwords, full names, phone numbers, addresses and workplace details. The data were disseminated via Pastebin and a link to stashbox.org, accompanied by a message referencing the #OpFuckMohammad campaign and claiming infiltration of British institutions such as hospitals, financial bodies and city councils. The actor explicitly cited Islamophobic motivations for the leak, framing the operation as a protest against perceived Islamic influence. Prior to this same‑site attacks have been noted by the actor, indicating a repeated focus on the same platform. No specific malware families, initial‑access vectors or custom tooling are described in the available reporting, with the breach appearing to involve direct web‑application exploitation followed by public data dumping.

The #OpFuckMohammad campaign represents the most clearly documented operation attributed to theinfidel, highlighting a strategy of ideological disruption through the exposure of personal information from community‑oriented websites. While the actor has claimed broader infiltration across various UK sectors, no evidence of state sponsorship, criminal consortium affiliation or sustained espionage activity is presented in the sources. Consequently, the profile is limited to the confirmed facts of the actor’s alias, UK location, targeting of a UK Islamic information service, the use of public paste services for data leakage, and the stated Islamophobic objective behind the #OpFuckMohammad operation.

Incidents

Attributed incidents are available to members.

1 incident

Sources

Sources available to members: 1 source.

CSIDB