The AOL hacking tool that invented phishing and inspired a generation

If you were a teenager on America Online back then, there’s a good chance you got the email. Unlike a lot of the files floating around the early warez scene, the attachment wasn’t a pirated copy of Photoshop 3.0 or a beta of Windows 95. In fact, it was being given away by its creator, a hacker who called himself “Da Chronic.” When you launched it, the title screen depicted the giant disembodied head of AOL CEO Steve Case floating in a sea of flames, set to a funky excerpt of Dr. Dre’s “ ">Nuthin’ but a ‘G’ Thang.” The title, rendered in 3D, spelled out just how far outside of the known, pixelated world you had come: “AOHell.”

In 1995, AOL was how most people in America were getting online, dialing in on 14.4 or 28.8 kbps connections, 33.3 if you were lucky. What you heard after the modem’s hysteric screeches was “Welcome!” and “You’ve got mail!”—as if the internet was your new home. And yet, while it began offering access to the nascent World Wide Web in 1995, AOL itself wasn’t technically the internet; it was more like a walled, manicured garden, with a set of cheery web-page-like brand-filled spaces known as “keywords” and a growing warren of official and unofficial chatrooms. 

This story is part of 1995 Week, where we’ll revisit some of the most interesting, unexpected, and confounding developments in tech 30 years ago.

AOHell was the first of what would become thousands of programs designed by hackers to turn this whole system upside down. Built with a pirated copy of Microsoft Visual Basic on a rented computer, the program combined a pile of tricks and pranks into a slick little control panel that sat above AOL’s windows and gave even newbies an arsenal of teenage superpowers. There was a punter to kick people out of chatrooms, scrollers to flood chats with ASCII art, an email and instant message bomber, a mass mailer, and even an “Artificial Intelligence Bot.” AOHell could also provide users “free” access to AOL, through a credit card generator (which fooled AOL’s sign up process), and, by January 1995, a function for stealing other users’ passwords and credit card numbers. With messages masquerading as alerts from AOL customer service reps, the tool could convince unsuspecting users to hand over their secrets. Da Chronic and his friends called it “fishing,” or, in the style of hackers, “phishing.” 

The program was a form of protest, Da Chronic would tell reporters who managed to reach him at the time (through an anonymous remailer). AOL regularly cracked down on hacker chatrooms, he said, but did little about the “pedophiles and child abusers” who used its platform to trade GIFs and prey on young users. Outraged by the hypocrisy, he wanted to send a message to the internet’s first corporate overlords. As he wrote in his Read Me file, “I think having 20,000+ idiots using AOHell to knock people offline, steal passwords and credit card information, and to basically annoy the hell out of everyone is a good start.”

But there were other reasons, too. Da Chronic—who was actually a 17-year-old in North Carolina named Koceilah Rekouche—had to hack AOL because he wanted to stay online with his friends. He didn’t want to pay the hourly fee, because he couldn’t afford to, and he didn’t want his friends or anyone else to pay either. He wanted everyone in, wanted any teen on AOL to feel the thrill of punking and pranking and using the system exactly how it wasn’t meant to be used.

Still, Rekouche wasn’t really thinking about where this was going. He couldn’t anticipate the fame—or the fear and paranoia—that would come with being AOL’s most notorious hacker. (His tools caused abuse and fraud and, AOL claimed, millions of dollars in losses.) He also could’t have imagined that his program would mark the start of automatic phishing, which would become the cornerstone of modern cybercrime.

At the same time, Rekouche also didn’t realize what else AOHell would come to represent: a free, freewheeling creative outlet for thousands of lonely, disaffected kids like him, and an inspiration for a generation of programmers and technologists. By the time Rekouche left AOL in late 1995, AOHell had spawned a whole cottage industry of teenagers making their own programs, and fueled subcultures where legions of young programmers and artists got their start hacking and breaking and making things.

“AOHell made me want to learn to program,” Steve Stonebraker, a cybersecurity expert and host of the podcast AOL Underground, told Klint Finley in 2022. “It was the starting point for this whole generation.” (Rekouche appeared on the podcast that year.) In 2014, Case himself acknowledged that “the hacking of AOL was a real challenge for us,” but that “some of the hackers have gone on to do more productive things.” That included Mark Zuckerberg, who had confessed to Case that ”he learned how to program by hacking [AOL].”

Rekouche’s relationship with his creation remains complicated. It’s easy to be nostalgic for the Wild West of AOL, where “we were just exploring the internet for the first time and causing chaos and being delinquent and finding friends.” But he tries not to dwell too much on the legacy of AOHell, or the internet that followed, with its algorithmic hellscapes where criminals and companies alike are still finding new ways to manipulate users. If he did, Rekouche jokes, “I might have to go rogue and start destroying again.”

This interview has been edited and condensed for clarity.

When did you get online? 

I got on AOL in early ‘94 when they were still on version 1.1 of Windows. It was me and my sister—she rented the computer and we shared it. AOL had a public rooms list, and then a customs rooms list where people can make their own rooms. That’s how I found the Tips and Tricks room.

What was it like to be in there?

I don’t think I’d ever been in a chatroom before, maybe once on a bulletin board. I was kind of like a loner social outcast anyway, so it was my groove. I liked it because it was social, yet you still had some distance from everyone. But I just fell in love with it, finding kids on there that were like me, that were kind of smart and nerdy and just into the things that I’m into. And it was a blast. I was just learning about computers. I didn’t know anything about them. We had an old slow computer, and so I had to learn all kinds of tricks just to get my thing to work. 

What was one of the coolest tricks you learned?

It was called IM stealing, and basically what you would do, on a Windows keyboard, you’d hold the alt key, and you’d type in 0 1 2 8, and then release the alt key. And that would create this special character, an eight bit Unicode character, that AOL’s backend system wasn’t built to properly filter. So you know buffer overflows? A lot of exploits on the web have to do with parsing problems, where you can insert code into a field, and if the parser doesn’t parse it right, then the code is actually executed. That’s exactly what was happening back then, in ‘94, except through AOL’s proprietary system. They never expected somebody to type in an eight bit unicode character like that. 

And what would happen was the most wild thing: apparently every IM that was sent on AOL at that particular second would get rerouted to your computer. And so as soon as you sent that character, a dozen IMs would pop up on your screen, with all these people talking to you, in the middle of their conversations. The person they were talking to, their name would turn into your name. The first time I did it, this guy’s like, You son of a—I’m reporting you hackers! You did this again—this is the last time! 

It’s like, get off my lawn!

Looking back, I think that’s what hooked me, that thrill. I was very, I wouldn’t say antisocial but anti-authoritarian. I quit high school at 15. The way I looked at school—at least the North Carolina Public School system—is that it was a prison. And my family life wasn’t great. And so, without going into a lot of personal stuff, I always had this whole anti-authoritarian attitude. So getting onto AOL and doing this stuff and seeing these tricks and finding these other mischievous kids like me, it was just a great fit.

I don’t know if you remember, but to get on AOL, you only had those 10 hour [floppy trial] disks. And after you spent your 10 free hours, of course you had to start paying $3.50 an hour. And to me back then, that was way too expensive. 

But it was like crack. I mean, I loved it so much, it became an obsession: Okay, how do I get more of these 10 hour disks? 

This was before AOL started sending promo disks and then CDs to almost every home in America. So: at some point, your free hours run out. How did the more serious hacking start?

As far as illicit activity in general, it started with creating an account with a false name and a fake bank account number to get free hours—you could create an account by just putting in your routing number and your checking account number, because I hadn’t yet discovered how to generate credit cards.

How did you get from there to AOHell?

We stopped hanging out in Tips and Tricks and started creating our own public rooms, with various names of hackers. And TOS Advisor [the screenname for AOL administrators] would just come around and shut us down. So my friend Rizzer says, Hey, why don’t we just all agree to go into private room hack? And so we did, and all our friends—it was about 15, 20 people tops that would rotate in and out of this room—we would have macro programs that would perform tricks for us. Mostly it was scrolling ASCII art. 

One day Rizzer shows me this thing that he made. It was basically a Windows form with a button on it. You enter in someone’s screen name and what you want the person to say, and you just hit a button. It performed text manipulation for you. And text manip was a way to talk using someone else’s name in the chat room. 

I’m like, “Dude, this is awesome. How did you make this?” And he told me it was something called Visual Basic. And so I download it, and all I can think of is: okay, all the tricks that we do—Text manip, ghost [a trick that cleared a chat room of all conversations], all that stuff—we need to have functions for all of it. And I want to get this out there. I want to make a cool-ass program everybody can use, and distribute it. 

I released AOHell 1 by myself, but I learned from Rizzer’s beta code. And then I’m like, Hey, why don’t we just work on AOHell together? And then we just had feature after feature. 

What kind of response did you get from the l33t hacker scene on AOL?

There was pushback. There were people who would tell me, these are our secrets! There were people that just hated the fact that I was distributing this thing, putting it into the team chat room, and bringing in all these n00bs and lamers and destroying the community. And in my eyes, that’s the exact opposite of what’s happening. Like, we’re creating a cool place and yeah, these little 14-year-olds are coming in—they’re script kiddies, but so what? We were in their shoes a couple years ago and one of these little fuckers is going to end up creating something cool anyway. 

And then there was my original core group of friends from AOL who didn’t give a shit about AOHell at all, because they just basically moved on to IRC and other things. And ironically, those are the people that I ended up putting in the greets of AOHell [laughs]. So, after they all basically migrated to IRC, I would have my social life there, and then on AOL my whole idea there was just to build this tool. 

Where you were already a legend.

Once you start getting, like, fame—everybody knew who I was—then you start getting hundreds and hundreds and hundreds of people. I couldn’t be myself. I couldn’t even identify myself. If I go into a chat room with my name, first of all, nobody would believe me. Second of all, if they did, it would just be a bunch of chaos. 

The media was starting to write about it, too.

I subscribed to PC World and I remember getting the magazine in the mail and them having a short article on AOHell. And when I saw that physically in print for the first time, that’s really when it hit me. But it was all surreal. It was wild, dude. 

Were you concerned that AOL was going to come after you at some point?

I became more paranoid about that later, as things really got big, and I realized just what the hell I had done. But at first, not so much. I just didn’t give a shit. Like: what do I have to lose? I didn’t have any prospects of doing much anyway.

Well, you were learning so much at the time. What was that like?

The very first coding stuff I picked up from Rizzer, and then I would download books and try to read the help files. It was mostly a trial and error process. I was not one of these types that sat down and learned how to program and then learned all the proper formalities, and then go and try to tackle a problem. I came at it from the reverse end where, Okay, this is a problem, or I want to do this particular really cool thing. How do I do that in this code? Let’s experiment. And then I had to learn error handling and certain things like that. But it’s like spaghetti: I understand kind of what this does; let’s throw some shit together and see what happens.

But it worked.

There were people making high level programs that were on the scene at the same time as me, and they would look at my code and snicker. But the thing with me was, I didn’t give a shit. Because it only mattered what the end user sees. Does this feature work? Is it cool as fuck to look at? Yes. Does it take two seconds longer to function because I’m a shitty programmer? Yes. But does that matter in the long run? Does the 14-year-old on the other side of the screen give a shit, because he’s able to flood all his friends offline and act like a God? Yes, it took two seconds longer because I’m not an efficient programmer, but I came up with this cool idea, and made it work, and this kid’s a God in front of his friend’s eyes—or whatever kids get off on. That’s the way I looked at it, at least.