Skip to content
Naked Security Naked Security

The Momo Challenge urban legend – what on earth is going on?

Why you shouldn't worry about the Momo Challenge, and what we can learn from it.

Some ideas are so good at getting people to spread them that they go viral.

There doesn’t have to be any design, purpose or merit in an idea to make it spread. It doesn’t have to be good, interesting, helpful, useful or true, in fact it can even be a very bad, even harmful, idea. All it has to do to spread is trigger our urge to share it with others.

One way to do that is to trigger the deep, primal urge inside parents to protect their children (and the deep primal urge within online news outlets to scare parents for clicks). And, over the last week or so, that’s exactly what the an idea called the Momo Challenge has been preying upon.

This article is about why you shouldn’t worry about the Momo Challenge, how we got here, and what we can usefully take away from this situation.

I’ll start by looking at what the Momo challenge is and isn’t.

What is the Momo Challenge?

The Momo Challenge is a modern equivalent of a campfire-side horror story.

Its fifteen minutes of infamy began with a story about a “haunted” WhatsApp account with the name Momo and a very creepy picture of a woman’s distorted face for an avatar.

The avatar is actually a much-shared picture of a sculpture called Momo (Mother Bird), made by a special effects company and exhibited in the Vanilla Gallery in Tokyo, Japan. The photo is much more disturbing when it’s cropped to show only the Mother Bird’s human head, and that’s the picture most often associated with Momo.

Legend has it that users who attempted to contact the Spanish-speaking WhatsApp account were mostly ignored but occasionally rewarded with responses in the form of “insults … and disturbing images”.

In a July 2018 video called Exploring The Momo Situation, YouTuber ReignBot took a look at the challenge and concluded that, by mid-2018:

The Momo thing is much more akin to an urban legend right now … People are claiming what Momo is and what Momo does, but not that many people have actually interacted with the account. Finding screenshots of interactions with Momo is nearly impossible.

Viral ideas often start life in one form and only explode into our collective consciousness after mutating (perhaps just through endless retelling) into something more frightening, and that seems to be what’s propelled Momo too.

Over time the idea seems to have undergone two important mutations.

At some point what people mean by The Momo Challenge seems to have changed from a story about a WhatsApp account into a new name for a completely different urban legend called The Blue Whale Challenge.

The Blue Whale Challenge is a story about a game in which players have to perform acts of self harm, before winning the game by committing suicide.

In both cases it’s important to note that the phenomenon isn’t the game, which almost certainly never existed, but stories about the game, and stories about stories about the game.

The second, more recent mutation to the idea seems to have occurred in the last week: that the Momo Challenge is appearing in the middle of innocent YouTube videos about things kids like, such as Peppa Pig and Fortnite.

For parents like me, whose kids love watching YouTube videos, that’s a terrifying thought. But, like the previous incarnations of Momo, that terrifying thought is being triggered by hysterical stories and warnings about videos, not by actual harmful videos, for which there seems to be no evidence at all.

The one verifiably real thing in the whole Momo saga, which seems to have propelled the meme on its journey, is the unsettling picture of the Mother Bird’s head. It’s a creepy picture which, by itself, might be enough to scare children.

What should you do?

Please, now you know what Momo is, don’t spread the hoax, and think twice the next time you receive a similar warning. When situations like this occur it’s entirely understandable that people want to warn others, but it’s normally counterproductive.

For example, thanks to unfounded social media chatter and the ensuing wall-to-wall media coverage, children are now talking to each other about Momo in the playground, and the scary Momo picture is all over the internet (but not in this article – if you want to see it, take a look at Momo’s Know Your Meme page.)

Entirely because of those warnings there’s a now a good chance your children will see the picture, and you should probably talk to them about what it is, and what it’s not, before they do see it.

All the attention that Momo is getting also increases the chance of copycats, or of scammers using it in social engineering attacks on kids or parents.

As a general heuristic, I recommend that you treat all unsolicited warnings about specific computer security threats as hoaxes, unless they come from reputable computer security organisations. And, I recommend you focus on doing the basics right rather than worrying about how to deal with specific threats.

You and your children are at some risk from a wide variety of online dangers all the time. There are too many to deal with on a case-by-case basis and getting cybersecurity right isn’t about doing one thing, it’s a process.

When it comes to your children, that means knowing what they’re doing online.

What that looks like is going to vary from one family to another, but here’s what we do in our house, with children under ten:

My children have time-limited access to a Mac laptop with parental controls enabled. If they want to use the computer they have to ask, and they have to say what they’re going to do. Their access to messaging is limited to email, which is restricted to classmates and, since they’ve only just started to use it, has to be done with a parent, so we can teach them the dos and don’ts.

Their favourite activity of all is looking at YouTube videos (almost always about Minecraft) but they are only allowed to look at videos by authors we have vetted and subscribed to, and they have to do it in a room with a parent in it.

If you’ve used different rules successfully, particularly with older children, I’d love to read about them in the comments below.

For more on the Momo Challenge, take a look at yesterday’s Naked Security Live video about Momo, embedded below.

(Watch directly on YouTube if the video won’t play here.)


Great article and video (as always!). It’s so strange to see the news outlets shoving this down our throats to get clicks or sell papers while pretending to care about our childrens safety. But, as you mention, this should be a wakeup call to actually talk about cyber security to our kids and what to look out for.

And for some parents, just to actually ensure you know what your kids are doing online, as difficult as that can be!


Can Sophos help block this sort of thing?


As the article explains, “blocking” urban legends requires each one of us to restrain ourself from repeating them as truth, so that the rumours don’t get the credibility they don’t deserve…

Please, now you know what Momo is, don’t spread the hoax, and think twice the next time you receive a similar warning. When situations like this occur it’s entirely understandable that people want to warn others, but it’s normally counterproductive.


We have a close family friend whose son when asked if either of the two children have seen the image has said he has seen the video with it saying to harm others or it will harm them. He said it popped up in a game he was playing.


Apologies John, but your comment as stated sounds like effort to perpetuate the rumor. If it’s true, then continuing Mark’s security-as-a-mode-of-thought my I.T. hat compels me to questions, beginning with:
a) which game?
b) what action in the game did he do that might have triggered/allowed it?
c) did it actually “pop up,” or did someone merely mention it in chat?
d) was it a shared link, or did the image (and “challenge”) actually manifest in-game?
e) was it someone sharing the meme, the actual “threat,” or merely the name and image?

Expounding on the article’s theme of critical thinking before the “share” button, questions along this line can lead to unmasking either a hoax or a threat worth pursuit.


It’s not just something people are talking about there was 30 suicide attempts (not sure if they were followed through) in Russia and 1 12 year old girl in the United states discovered thus far
If it’s a just a “hoax” why and how is it interrupting you tube videos saying these creepy things to children?


This kinda stuff has only come up AFTER the media has made a big deal about it, just people trying to make a quick but via ad revenue. The suicides were followed up and all of them were unrelated.


That’s all part of the hoax. Ask yourself: have you seen verifiable documentation about the “30 suicide attempts in Russia” or the “12 year old girl in the US”? Have you seen it “interrupting YouTube videos, saying creepy things to children”? Or have you just heard other people claiming that’s what’s happening? Because that’s what hoaxes and legends are, and that’s how they spread.

This is what we need to educate ourselves about; we need to learn to ask questions whenever we’re presented with the latest internet gossip/outrage/claim. We need to learn to differentiate between truth and fiction.


its maybe more of a scam than a hoax, as it is the dumbest challenge in the world right now. One friends child saw it and thankfully showed it to the parent, told them to do challenges/task (simple dumb things, then dumber/ more malicious as the victim plays along), the last one of which is always to kill someone else or your self. I call it a cooking pot for Darwin award candidates. (frog in cooking pot reference).
Kids need parenting, there is no Santa, oops I mean Momo, just another human messing with people.


Hah. My gf showed me this meme yesterday, first I’d heard of it. She didn’t think it was real either–and we confirmed via Wikipedia.

Told her any game where you “win” by killing yourself sounds to me like Darwinism.


I really appreciate you sharing this, I had only seen articles about it from Facebook and as a new father of a 9 month old i was terrified to ever let her near electronics. Glad to know it was blown out of proportion.


Hi Anon. My offspring a bit older, I can reassure you from experience. Be involved in your kids’ activities and point them in the right direction. Eventually they’ll make all their decisions without you, and their ability to think on their feet will bring them to either sinking or swimming. …which in turn will bring you comfort or a state of unease.

No good parent remembers this at every single teaching opportunity, but all good parents consistently try to.


And this Momo case specifically calls to mind the adage we all know, “if it’s too good to be true it likely is:”

If it’s so horrific it can’t possibly be true it either
a) isn’t true, or…
b) it’s U.S. politics


As ever a very good and informative article. My 4 year old son’s school sent a letter about the Momo Challenge. While they made the mistake of not checking it was a hoax, they were at least sensible in their suggestions and suggested a lot of it was media hype.

For what it’s worth, I’ve just installed the YouTube Kids app on our devices and set that up for my little boy. They stress the content is ‘machine picked’, rather than checked by people, but so far he’s not wandered from Baby Shark to Grand Theft Auto which he did on YouTube in the past!


Great article. As a parent of 2 young kids who love to watch youtube, I did my own research into MOMO and the like and estalished it was more urban legend and media scaremongering than anything else but it does make me more protective of my little people. They both have specific Amazon Kindle for kids tablets also with pre-approved videos from genuine publishers on there and strict parental controls to prevent them breaking out and getting into any more harmful. Thank you for breathing some clarity and reality into a situation that was picking up too much negative momentum :)


Thanks for the article and I like the way you encourage the sharing of internet safety ideas. Here’s what we do (kids age 9 and 6) and it’s a forever evolving process. Keen to hear anyone else’s ideas. Essentially we have an iPad for games and entertainment and a laptop for doing homework and research.

– iPad has parental controls and age limits set. This is in no means a decent filter but a good starting point.
– No email or messaging allowed until they are older
– For any apps they want, I sit with them and we read the reviews together and dig around for the low star ratings. We check out in app purchases and make sure my password is required and that no gambling is encouraged to earn extra credit or coins
– we stick to kids only apps (YouTube for kids etc)
– laptop set up so kids have their own log in. No website allowed until admin (me) has approved. Once approved they are free to revisit. This is very involved at the start, but they are getting a sense of process – check it’s appropriate for kids, make sure strangers can’t contact them, make sure images and content are not offensive. Once we’ve gotten through that I tell them to have fun and enjoy because aside from the dangerous aspect the internet is a ball of fun and games are there to enjoy.
Love to hear any other tips…


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!