Sextortion: when someone threatens to distribute your private and sensitive material if you don’t provide them with images of a sexual nature, sexual favors, or money.
An old email scam has resurfaced with a new twist that serves to make the con far more believable. The message purports to have been sent from a hacker who’s compromised your computer and used your webcam to record a video of you while you were watching porn. The official looking mailing threatens to release the video to all your contacts unless you pay a Bitcoin ransom.
This has to be a record. No less than 6 customers have come to us after receiving derivatives of this age old scam. What makes it appear especially authentic is that the email now references a real password previously tied to the recipient’s email address. “I’m aware that <substitute password formerly used by recipient here> is your password,” reads the salutation. In every case, the recipients password referenced in the email’s opening sentence was in fact a password they had previously used at an account online that was tied to their email address.
It is likely that this improved sextortion attempt is at least semi-automated: The perpetrator has likely created some kind of script that draws directly from credentials from online data breaches that occurred in the past. Each victim who had their password compromised as part of that breach is getting this same email at the address used to sign up to those hacked sites. As this scam gets even more refined, perpetrators will begin using more recent and relevant passwords — and perhaps other personal data that can be found online — to convince people that the hacking threat is real.
According to the FBI, here are some things you can do to avoid becoming a victim:
-Never send compromising images of yourself to anyone, no matter who they are — or who they say they are.
-Don’t open attachments from people you don’t know, and in general be wary of opening attachments even from those you do know.
-Turn off [and/or cover] any web cameras when you are not using them.
________________
The Gory details:
“I’m aware that <substitute password formerly used by recipient here> is your password,” reads the salutation.
You don’t know me and you’re thinking why you received this e mail, right?
Well, I actually placed a malware on the porn website and guess what, you visited this web site to have fun (you know what I mean). While you were watching the video, your web browser acted as a RDP (Remote Desktop) and a keylogger which provided me access to your display screen and webcam. Right after that, my software gathered all your contacts from your Messenger, Facebook account, and email account.
What exactly did I do?
I made a split-screen video. First part recorded the video you were viewing (you’ve got a fine taste haha), and next part recorded your webcam (Yep! It’s you doing nasty things!).
What should you do?
Well, I believe, $1400 is a fair price for our little secret. You’ll make the payment via Bitcoin to the below address (if you don’t know this, search “how to buy bitcoin” in Google).
BTC Address: 1Dvd7Wb72JBTbAcfTrxSJCZZuf4tsT8V72
(It is cAsE sensitive, so copy and paste it)
Important:
You have 24 hours in order to make the payment. (I have an unique pixel within this email message, and right now I know that you have read this email). If I don’t get the payment, I will send your video to all of your contacts including relatives, coworkers, and so forth. Nonetheless, if I do get paid, I will erase the video immidiately. If you want evidence, reply with “Yes!” and I will send your video recording to your 5 friends. This is a non-negotiable offer, so don’t waste my time and yours by replying to this email.
