theinfidel
Attribution profile
- Type
- Activist
- Location
- United Kingdom
- Known incidents
- 1 incident
- Sources
- 1 source
- First seen
- 2014-02-17
- Last seen
- 2014-02-17
- Updated
- 2026-08-01 02:37
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor known as theinfidel, also operating under the Twitter handle @th3inf1d3l, is based in the United Kingdom. This alias has been associated with a series of data‑leak incidents targeting online platforms, most notably a breach of a UK‑based Islamic community site in February 2014. The actor’s public statements and the nature of the leaked material indicate a pattern of ideologically driven activity rather than financially motivated crime.
In the 2014 incident theinfidel compromised muslimdirectory.co.uk, extracting 38 903 user records that included email addresses, plaintext passwords, full names, phone numbers, addresses and workplace details. The data were disseminated via Pastebin and a link to stashbox.org, accompanied by a message referencing the #OpFuckMohammad campaign and claiming infiltration of British institutions such as hospitals, financial bodies and city councils. The actor explicitly cited Islamophobic motivations for the leak, framing the operation as a protest against perceived Islamic influence. Prior to this same‑site attacks have been noted by the actor, indicating a repeated focus on the same platform. No specific malware families, initial‑access vectors or custom tooling are described in the available reporting, with the breach appearing to involve direct web‑application exploitation followed by public data dumping.
The #OpFuckMohammad campaign represents the most clearly documented operation attributed to theinfidel, highlighting a strategy of ideological disruption through the exposure of personal information from community‑oriented websites. While the actor has claimed broader infiltration across various UK sectors, no evidence of state sponsorship, criminal consortium affiliation or sustained espionage activity is presented in the sources. Consequently, the profile is limited to the confirmed facts of the actor’s alias, UK location, targeting of a UK Islamic information service, the use of public paste services for data leakage, and the stated Islamophobic objective behind the #OpFuckMohammad operation.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 1 source.