There is a significant amount of online human activity which is either clandestine or illicit in nature, and hence where individuals operate under fear of exposure or capture. Yet there is little theoretical understanding of what models best describe the resulting dynamics. Here we address this gap, by analyzing the evolutionary dynamics of the supporters behind the 95 pro-ISIS online communities (i.e. self-organized social media groups) that appeared recently on a global social media site. We show that although they do not follow a conventional (i.e. size-based) preferential attachment (PA) model, their dynamical evolution can be explained by a new variant that we introduce here, which we refer to as active attraction model (AA). This AA model takes into account the locality and group heterogeneity which undoubtedly feature in humans' online behavior under pressure, but which are not contained in conventional PA models. The AA model captures both group-specific and macroscopic observations over all size ranges -- as opposed to just the tail for large groups or groups' initial growth -- suggesting that heterogeneity and locality play a crucial role in the dynamics of online extremist support. We derive approximate expressions for the group size distributions in two simple systems that involve simultaneously the mechanisms of group joining (governed by either PA or AA), group leaving, and account banning, and show how these processes influence the group size distributions. We believe this work will serve in helping understand a broad spectrum of online human activities which are either clandestine or illicit in nature, and hence where individuals operate under fear of exposure or capture.