How online groomers lure children into violent extremism

A screenshot from the ABS-CBN News documentary “May Halimaw sa Likod Ng Salamin.”MANILA — At 15, “Cosmo” — not his real name — entered an online community through a video game, believing he had found a place to belong.

Within a month, his world had changed. He was consuming mass-shooting content, buying knives, and being exposed to people who encouraged acts of violence.

Cosmo’s story reveals how online grooming can gradually turn a young person’s curiosity and vulnerabilities into tools for radicalization.

By the time he was 17, “Cosmo” had already seen and experienced what it means to be shaped by people he would later recognize as dangerous.

It began innocently enough, while he was playing an online game called Dandy’s World.

“While I was playing Dandy’s World someone came up and approached me to try out this community,” Cosmo recalled.

The invitation led him into a particular online space devoted to true crime. Eventually, conversations moved to another platform, where a stranger introduced him to a steady stream of disturbing material.

His social media feed changed, too. Videos featuring perpetrators of violent crimes began appearing more frequently, drawing him deeper into content about mass shootings and other horrific acts.

“There’s this one particular community I entered in, the true crime community,” he said. “It changed me a lot, you know, I started overthinking about stuff and then began consuming so much, so much things like violent media. Mostly mass shooting events.”

At first, it was curiosity. Then came fascination. And before he fully understood what was happening, the content had begun to affect his behavior.

“But as I consumed it, the horror there man, the horror,” he said.

Cosmo could not say with certainty whether the person who approached him was Filipino or a foreigner. What he did know was that someone had gained access to his world—and, little by little, had begun influencing it.

Cosmo’s experience illustrates how online grooming can begin in spaces where young people spend much of their time: online games, social media platforms and online communities.

The danger does not necessarily lie in the game itself, but in the relationships formed through it.

Bret Morales, a digital investigator and open-source intelligence analyst, said researchers have emphasized the role of communication in the online recruitment of vulnerable individuals.

“May mga study and researchers na po ang nagsasabi na it’s never about the game, it’s about the communication. Kasi yung sa mga games na yun, nakakapagsalita po tayong dalawa, nakakapag-usap ka parang ganito,” Morales explained.

According to Morales, online predators seek out people they perceive to be vulnerable, regardless of the platform they use.

Those vulnerabilities may include loneliness, social isolation, bullying, rejection, family conflict or abuse. Young people searching for identity, acceptance, recognition or a sense of purpose may also become targets.

He added that some individuals express anger toward their school, family, government, religion or society online.

“They are always seeking an online relationship to the community. So ‘yun po ‘yung na-notice ng mga predator,” Morales said.

For recruiters, these online spaces can provide opportunities to identify young people who are searching for belonging—and to position themselves as the people who understand them.

From Dandy’s World, Cosmo was eventually drawn to Discord, where he spent about a month interacting with members of the community.

Asked what they usually discussed, Cosmo said: “Mass shootings and serial killers.”

As his exposure continued, his interest grew into an obsession that extended beyond the screen.

“It got me fixated a lot… To the point I started buying the shirts they wore,” Cosmo recalled.

He also began adopting the language and ideas associated with the community. One phrase he remembered was “Natural selection”—a concept that, in some violent online subcultures, is used to justify contempt for others and frame violence as a form of supposed superiority or elimination.

His fixation soon manifested in more alarming ways.

“I started buying knives to be exact. A knife,” he said. “I just began stabbing a random thing. It’s cardboard. I was stabbing it so furiously. It’s like I’m taking my energy out of it. Then I felt thrilled after that.”

His grandmother eventually discovered what was happening and discarded the items, but the consequences had already reached beyond his online activity.

Cosmo was suspended from school after bringing a knife and pepper spray onto campus.

When asked why he had brought a knife to school, he explained that he wanted to be prepared in case an attack occurred.

His answer revealed how deeply the violent content he had consumed had begun to influence his perception of danger. Rather than simply watching stories about mass violence, he had started imagining himself in situations where weapons might be necessary.

It was a warning sign that his online experience was no longer confined to the screen.

A screenshot from the ABS-CBN News documentary “May Halimaw sa Likod Ng Salamin.”Cosmo’s experience occurred within a type of online environment that authorities and investigators associate with nihilistic violent extremism (NVE).

NVE networks are decentralized online communities whose members may express intense hatred toward society, promote the worthlessness of human life, or glorify violence as a means of expressing their beliefs.

Some members frequent true-crime communities (TCCs), where users discuss notorious crimes and the people responsible for them. 

While interest in true crime does not, by itself, indicate violent intent, such spaces can become points of contact for individuals seeking to recruit or influence vulnerable young people.

The process may begin with shared interests and seemingly ordinary conversations. Over time, however, recruiters can introduce increasingly extreme material and normalize ideas that would otherwise be alarming.

According to Usec. Renato Paraiso, Executive Director of Cybercrime Investigation and Coordinating Center (CICC), researchers identified six stages in the grooming process used by recruiters associated with NVE groups.

The first stage involves profiling potential targets on social media and gaming platforms.

“Una magpo-profile sila, sa social media platforms at mga gaming platforms… ‘Yung mga kabataan, predisposed na, o may inkling na, patungo sa karahasan, tsaka sa mga mature contents o explicit contents natin,” Paraiso said.

Recruiters then use chat functions to befriend their targets. Once a connection has been established, they attempt to move the conversation away from the original platform.

“Kinakaibigan nila yan using the chat functions. Gaya ng sa social media, or yung mga gaming groups na ito. pagkatapos nun, ang ginagawa nila dinadala nila off-platform,” Paraiso said.

Among the platforms Paraiso identified as particularly problematic were Discord and Telegram, where private groups and direct messaging can facilitate contact between users.

The movement to another platform can make the relationship more private, separating the child from the online space where the initial interaction occurred and potentially reducing the visibility of the conversations to parents or other adults.

Paraiso said these platforms can also be used to share extensive material — such as full-length movies — related to radicalization and indoctrination.

The objective, he explained, is to extract the child from the original online environment and draw them into a more controlled relationship with the recruiter.

Once a recruiter has identified a target and isolated the child from the original platform, the next stage may involve what investigators call love bombing.

The recruiter overwhelms the young person with attention, affection and apparent concern, creating the impression of a close relationship.

For a child who feels lonely, rejected or misunderstood, that attention can be especially powerful.

But the affection may come with conditions.

According to Paraiso, recruiters can begin by assigning small, seemingly manageable tasks. These gradually become more demanding as the child becomes increasingly invested in the relationship.

Eventually, the tasks may be used to compromise or control the victim.

“Hanggang umabot siya sa isang task na ang purpose na nun ay blackmailing na,” Paraiso said.

Paraiso explained that blackmail may involve pressuring a child to send explicit material or something that could later be used to humiliate or threaten them.

At that point, the relationship can become increasingly difficult for the child to escape. Fear, shame, emotional dependence and threats may all be used to maintain the recruiter’s influence.

In some NVE-related cases, that influence can extend to the encouragement of violent acts.

For Cosmo, the conversations had already begun moving in that direction.

A screenshot from the ABS-CBN News documentary “May Halimaw sa Likod Ng Salamin.”During his month in the community, Cosmo said members discussed not only mass shootings and perpetrators but also actions that could be carried out by people within the group.

He recalled being told that anyone planning an attack should livestream it.

“First thing is it’s like if you wanna do an attack, gusto mo i-live. They tell you to live stream it first just like what happened in Zamboanga,” he said.

He was also exposed to discussions about acquiring equipment that could be used to carry out attacks.

“Before you do your attack, they’re asking you to buy gears. Equipment na gagamitin mo na para magtake ka ng other lives. For example, weapons, handguns, rifles, shotguns, anything,” said Cosmo.

Such conversations can transform violence from something a young person observes into something a group presents as an achievable objective.

The repeated exposure to violent content, the influence of online peers and the gradual normalization of increasingly extreme ideas can blur the line between fascination and participation.

Cosmo said he eventually decided to leave the community after a serious incident in Tacloban.

“When Tacloban happened, because it was a very serious incident that happened in San Jose. That instant puts a life in danger. I decided that I wanna leave this community,” he recalled.

He had reached the fourth stage of the grooming process identified by investigators before the experience came to an end.

His departure, however, does not erase the warning signs that emerged along the way: his growing fixation on mass shootings, the purchase of knives, and the decision to bring weapons to school.

His case underscores how early intervention can matter when a child’s online behavior begins to change.

While Cosmo was being drawn deeper into the online community, his grandmother, Tina— not her real name— initially had little reason to suspect the extent of what was happening.

She had cared for him since he was five years old. She remembered him as a cheerful and gentle child who was kind to his younger sibling.

“Jolly po siya, mabait. Hindi po siya nananakit sa kapatid niya. Napakabait na bata tapos lagi nag-I love you,” Tina recalled.

The first changes she noticed were subtle.

Cosmo, who was usually attached to her, began spending time on his cellphone speaking in English. When conversations appeared to become serious, he would retreat to his room and stay there for long periods.

One day, Tina overheard him responding firmly to someone on the phone.

“No. I’ll never do that,” she heard him say.

When he came out of the room, she asked what the other person had been telling him to do.

The conversation raised an even more disturbing concern: someone in an online group chat had been asking Cosmo an inappropriate sexual question.

Tina recalled hearing him explain that he had refused because he did not know about the subject and feared his grandmother would be angry. She asked whether he knew the person. Cosmo told her they were connected through a group chat on Roblox.

The discovery frightened her. She immediately told him to leave the group and cut off contact with the people he had met there.

For Tina, protecting Cosmo meant becoming more vigilant about his daily routine. She coordinated with his school and made sure he was accompanied to and from campus, checking that he had entered the school premises and personally meeting him at dismissal.

“Napakahirap po sa katulad ko po na, na ako ay guardian lang. Na kailangan ko talaga siyang protektahan dahil ipagkakatiwala lang po sa akin yan,” she said.

“Napakahirap po sa akin na mawala siya sa paningin ko.”

Her fear reflects a challenge faced by many guardians: children can form relationships with strangers in spaces adults may not fully understand, and the changes caused by those relationships may not be immediately apparent.

By the time warning signs emerge, a child may already have developed a sense of loyalty toward the person influencing them.

In Cosmo’s case, Tina’s intervention helped stop the contact. He no longer communicates with the groomer, and his guardian continues to work with the school to keep him safe.

It can begin with a friend request, an invitation to join a community, or a conversation with someone who seems to share a child’s interests.

The danger lies in how that connection develops: whether the stranger begins demanding secrecy, moving conversations to private channels, introducing increasingly disturbing material, assigning tasks, or pressuring the child to do things that make them uncomfortable.

A sudden change in behavior, excessive secrecy around online conversations, unexplained fixation on violent content, or contact with unknown individuals should prompt careful attention—not an automatic assumption that a child is being groomed, but an opportunity to ask questions and understand what is happening.

For Tina, the lesson is simple: adults must not dismiss changes in a child’s behavior.

“‘Wag po nating ipagba—ipagwalang bahala kung sakali mang ang magulang nakakita na ng pagbabago sa anak, makipag-ugnayan na po siya sa, open communication na po sa mga anak,” she urged.

Creating a safe space for children to speak about their online experiences can help adults identify troubling interactions before they escalate. Shaming or immediately blaming a child may make it harder for them to disclose what has happened.

When there is an immediate safety concern, experts say that families should seek help from the school, appropriate child-protection authorities or law enforcement, particularly if threats, coercion or weapons are involved.

Cosmo now has a message for others who may find themselves in situations similar to where he had been.

“If any of you is struggling, seek help immediately,” Cosmo said.