A month after the Trump administration began its immigration enforcement operation in Minneapolis, right-wing creators are turning their attention to a new target in search of fraud: California.

Over the last few weeks, right-wing creators who were instrumental in boosting the Minnesota fraud allegations that predated the administration’s surge of federal immigration agents have been going after a number of California’s social welfare programs, making unsubstantiated accusations of fraud—and potentially laying the groundwork for a similar federal crackdown in the nation’s largest Democrat-run state. They’re already getting support from some of President Donald Trump’s key allies too.

Nick Shirley, the right-wing influencer whose viral YouTube video claimed to uncover a purported $100 million fraud scheme involving Somali childcare centers in Minnesota, posted to Instagram over the weekend announcing his arrival in California. “Secrets out,” Shirley wrote in an Instagram story set to Katy Perry’s “California Gurls.” It’s unclear what exactly Shirley plans to do, but he claims to be “investigating” Somali-run childcare centers in California as well, according to posts that circulated on X over the weekend.

Shirley is working with Amy Reichert, a private investigator and failed politician who claims to be investigating “ghost daycares” in California. In his Minnesota video, Shirley “investigated” the fraud by showing up to daycares asking to see children. He appears to be applying the same method in San Diego. Reichert posted a picture with Shirley to X on Saturday, writing “California, here we come! When @nickshirlye drops the video, it’s going to be 🔥.” (Local Minnesota outlets published multiple stories covering childcare fraud years before Shirley’s video came out.)

On Sunday, Benny Johnson, a pro-Trump creator and Turning Point USA contributor, published his own “documentary,” in a similar vein to what Shirley filmed in Minnesota. In it, he claimed to reveal a multimillion-dollar “homeless industrial complex” in California. Johnson teamed up with two Republican gubernatorial candidates, Riverside County Sheriff Chad Bianco and Steve Hilton, a former adviser to UK prime minister David Cameron, in the video, which they claimed was an attempt to uncover fraudulent uses of federal funding to support California’s unhoused. Johnson also claimed that the state was “using these federal dollars to rig national elections.”

California governor Gavin Newsom’s office rejected the claims Johnson made in an X post on Sunday, calling the video “literally the conspiracy theory meme in real life.”

Johnson’s most recent video attempts to claim that California’s homeless shelters are primarily filled with undocumented immigrants. His main piece of evidence is a phone call with a purported “whistleblower” whose identity was concealed. (Newsom’s office responded to this claim, calling it “as real as our Free Unicorn for all undocumented people program.”)

The same week Johnson announced that he would be traveling to California to uncover “fraud,” Trump called California “more corrupt” than Minnesota in a post on Truth Social. “Fraud Investigation of California has begun,” Trump wrote. Last week, Trump named a new assistant attorney general, Colin McDonald, to focus on fraud investigations at the Justice Department.

Other large pro-Trump accounts and news outlets, like Real America’s Voice, are boosting Johnson’s recent video. Larry Elder, talk radio host and former presidential candidate, reposted the video on X on Tuesday, writing “Fraud in California makes that of Minnesota look like a starter kit.”

Elon Musk, who Shirley thanked for initially boosting his December Minnesota video, has also been elevating news coverage related to California fraud. “Truly insane levels of fraud!” Musk said, reposting a story from Fox News earlier this week.

The tried-and-tested ‘business models’ favoured by some of the world’s most adept, and dangerous, ransomware gangs are scaling rapidly as cyber criminals increasingly adopt structured affiliate models and actively seek out new recruits, including malicious insiders and even cyber pros themselves, according to NCC Group’s latest monthly round-up of the threat environment.

That cyber criminal gangs operate as an organised industry is of course nothing new, and is well-known and understood across the security industry and these days, beyond its confines.

However, said NCC, amid a 13% rise in recorded ransomware attacks during December 2025, the growing financial ‘success’ of ransomware gangs is enabling them to offer stronger financial incentives – including larger commissions – to their new recruits, and improved operational security (OpSec) measures, both signs of growing professionalisation in the ecosystem/

NCC’s Matt Hull said that ransomware-as-a-service (RaaS) gangs now view employees, contractors, and trusted partners as gateways into victim organisations, and enthusiastically target them in order to gain legitimate access to credentials, systems and processes. This allows them to both bypass security controls and dial back their reliance on the use of vulnerabilities that may be discovered and patched at any moment, which in turn reduces the risk of discovery and exposure prior to executing a cyber attack

He cited a well-reported incident in which the Medusa ransomware gang unwisely targeted the BBC by approaching its cyber security correspondent, Joe Tidy. The gang messaged Tidy on the encrypted Signal application to offer him 15% of a future ransomware payment if he gave them access to his PC. When this was rebuffed, Medusa’s recruiter upped the offer to a quarter of 1% of the BBC’s revenues, and promised Tidy he would never have to work again.

 “Targeting high-profile organisations like the BBC is both financially attractive and commercially strategic,” said Hull. “Even limited success against a well-known brand can generate notoriety and credibility, helping groups attract future affiliates and opportunities. Well-resourced groups like Medusa and Qilin can afford to use financial incentives to attract insiders, but smaller gangs often lack the means to compete.

“For organisations, this shifts the focus from purely technical defence to human risk management. Insider threat programmes, strong access governance and robust offboarding processes are critical to reducing the risk that current or former employees become part of the ransomware supply chain.”

But employees are not the only ones being targeted. In November 2025, the US authorities indicted three men accused of extorting a total of five known victims using the ALPHV/BlackCat ransomware. The sting in the tale was that all three worked in the cyber security field, specialising in incident response and ransomware negotiations. The Department of Justice (DoJ) said that one of the men became involved in the scheme because he was in debt.

Two of the accused, named as Ryan Goldberg and Kevin Martin, pled guilty to obstruction of commerce through extortion at the end of December 2025 and are due to be sentenced in March.

“Ransomware has evolved into an organised business model. These groups now think in terms of recruitment, incentives, scale and growth, rather than just attacks,” added Hull.

“What’s striking is that these tactics aren’t new. Trust, deception, social engineering and financial pressure have always worked, they’re just being organised and scaled in new ways. The recruitment of cyber security professionals shows how far this has gone: ransomware groups are exploiting expertise, access and human trust to operate like structured criminal enterprises.”