This article recounts the federal criminal complaint against 22-year-old Marco Antonio Aguayo of Anaheim, California, who allegedly posted violent threats targeting Vice President JD Vance and his family at Disneyland, describing the claims, how investigators traced the posts, and the federal charge now facing Aguayo.
Marco Antonio Aguayo is identified in a recently filed criminal complaint as the person behind a series of threatening social media comments aimed at Vice President JD Vance and his family during a visit to Disneyland last summer. The complaint says Aguayo, age twenty-two and an Anaheim resident, posted that pipe bombs had been placed around the park in preparation for Vance’s arrival. The posts were allegedly made on the Disneyland account and carried graphic language promising violence against “corrupt politicians.”
The complaint records three separate messages attributed to Aguayo that raised alarm among law enforcement and the Secret Service. Those posts are quoted exactly in the complaint and include claims that “Pipe bombs have been placed in preparation for J.D. Vance’s arrival,” a call to “rise up,” and the chilling line about bathing “in the blood of corrupt politicians.” These three distinct messages are central to the government’s case in establishing a deliberate threat rather than a single ill-considered post.
“Pipe bombs have been placed in preparation for J.D. Vance’s arrival,” the first comment read.
“It’s time for us to rise up and you will be a witness to it,” read the second.
“Good luck finding all of them on time there will be bloodshed tonight and we will bathe in the blood of corrupt politicians,” read the third.
Investigators say local police and a Secret Service agent interviewed Aguayo on July 12, 2025, after the posts were discovered. According to the complaint, Aguayo initially denied responsibility and claimed his account had been hacked, then later admitted he had made the posts and intended to delete them but forgot. The multiple posts and the specific threats against a protected official amplified the gravity of the situation for federal investigators.
The Secret Service inquiry reportedly connected an email address to the Instagram account used to post the threats, and Google subscriber records tied that email to Aguayo along with two phone numbers. The complaint says the suspect consented to a search of his phone, which investigators used to gather evidence supporting the charges. Those investigative steps are described as the means by which agents established probable cause in the case.
The criminal complaint cites probable cause that Aguayo violated federal law protecting the president and successors to the presidency, referencing 18 U.S.C. § 871. The filing includes the language: “For all the reasons described above, there is probable cause to believe that AGUAYO violated 18 U.S.C. § 871 (Threat against President and Successors to the Presidency).” That statute covers threats against the president and others in the line of succession and carries serious federal consequences.
At this point the complaint indicates a federal charge for making a threat against the president and successors to the presidency, but public records do not yet make clear whether Aguayo is in federal custody or whether he has obtained legal representation. The complaint itself is the primary document laying out the allegations, the investigative steps taken, and the statutory basis for the charge.
The behavior described in the complaint highlights how social media posts, even when later called “a joke” by their author, can trigger federal criminal investigations when they target public officials with violent threats. Law enforcement sources emphasize that repeated, specific threats aimed at a protected person are treated as serious and can lead to arrest and prosecution under federal law.
The case also shows the role of cooperation between local police and federal agencies, including the Secret Service, in responding to threats against high-profile targets. Digital forensics, subscriber data from online service providers, and consensual searches of devices are commonly used tools for establishing links between anonymous accounts and real-world suspects in threats and harassment cases.
Because the complaint is a public federal filing, its contents provide the factual basis prosecutors intend to use, but those allegations remain allegations until proven in court. The legal process that follows will determine whether the government can meet its burden and what penalties, if any, Aguayo may face if convicted under the cited statute.
Add comment