This paper considers an emerging practice whereby citizen’s use of ubiquitous and domesticated technologies enable a parallel form of criminal justice. Here, weaponised visibility supersedes police intervention as an appropriate response. Digital vigilantism is a user-led violation of privacy that not only transcends online/offline distinctions but also complicates relations of visibility and control between police and the public. This paper develops a theoretically nuanced and empirically grounded understanding of digital vigilantism in order to advance a research agenda in this area of study. In addition to literature on vigilantism and citizen-led violence, this paper draws from key works in surveillance (Haggerty and Ericsson, British Journal of Sociology, 51, 605–622, 2000) as well as visibility studies (Brighenti 2007; Goldsmith, British Journal of Criminology, 50(5), 914–934, 2010) in order to situate how digital media affordances and cultures inform both the moral and organisational dimensions of digital vigilantism. Digital vigilantism is a process where citizens are collectively offended by other citizen activity, and coordinate retaliation on mobile devices and social platforms. The offending acts range from mild breaches of social protocol to terrorist acts and participation in riots. The vigilantism includes, but is not limited to a ‘naming and shaming’ type of visibility, where the target’s home address, work details and other highly sensitive details are published on a public site (‘doxing’), followed by online as well as embodied harassment. The visibility produced through digital vigilantism is unwanted (the target is typically not soliciting publicity), intense (content like text, photos and videos can circulate to millions of users within a few days) and enduring (the vigilantism campaign may be top search item linked to the target, and even become a cultural reference). Such campaigns also further a merging of digital and physical spaces through the reproduction of localised and nationalist identities (through ‘us/them’ distinctions) on global digital platforms as an impetus for privacy violations and breaches of fundamental rights.