Society faces a fundamental global problem of understanding which individuals are currently developing strong support for some extremist entity such as ISIS (Islamic State) – even if they never end up doing anything in the real world. The importance of online connectivity in developing intent has been confirmed by recent case-studies of already convicted terrorists. Here we identify dynamical patterns in the online trajectories that individuals take toward developing a high level of extremist support – specifically, for ISIS. Strong memory effects emerge among individuals whose transition is fastest, and hence may become ‘out of the blue’ threats in the real world. A generalization of diagrammatic expansion theory helps quantify these characteristics, including the impact of changes in geographical location, and can facilitate prediction of future risks. By quantifying the trajectories that individuals follow on their journey toward expressing high levels of pro-ISIS support — irrespective of whether they then carry out a real-world attack or not – our findings can help move safety debates beyond reliance on static watch-list identifiers such as ethnic background or immigration status, and/or post-fact interviews with already-convicted individuals. Given the broad commonality of social media platforms, our results likely apply quite generally: for example, even on Telegram where (like Twitter) there is no built-in group feature as in our study, individuals tend to collectively build and pass through so-called super-group accounts.