Scam email with a stolen password and hacked webcam

There’s a new scam going around that would terrify most people if it ever landed in their inbox.

The emails are slightly different depending on who’s being attacked, but they all have a few similar features:

  • The subject line includes a password that you probably have used at some point
  • The sender says they have used that password to hack your computer, install malware, and record video of you through your webcam
  • They say they will reveal your adult-website habits and send video of you to your contacts unless you send them bitcoin, usually $1,000 or higher

Here’s an example of this scam email:

—–Original Message—– 
From: Felicity Gronback <bkcsloanwn@outlook.com
Sent: Saturday, 28 July 2018 7:16 AM 
To: you@email.com
Subject: yourname – oldpassword

youroldpassword one of your pass word. Lets get directly to purpose. There is no 
one who has paid me to investigate you. You don’t know me and you’re 
probably thinking why you’re getting this e mail?

Well, I actually installed a software on the 18+ streaming (porno) web site 
and guess what, you visited this website to experience fun (you know what I 
mean). While you were watching video clips, your browser started out working 
as a Remote control Desktop having a key logger which gave me access to your 
display screen and cam. Right after that, my software gathered your entire 
contacts from your Messenger, Facebook, as well as emailaccount. Next I made 
a double video. 1st part shows the video you were watching (you have a nice 
taste hehe), and second part shows the view of your web camera, & its u.

You do have just two options. We should review the solutions in details:

1st alternative is to dismiss this email. In that case, I most certainly 
will send out your very own tape to every single one of your contacts and 
then visualize regarding the shame you will see. Or should you be in a 
relationship, just how it can affect?

Latter alternative is to compensate me $1000. I will regard it as a 
donation. As a result, I will promptly erase your video footage. You can 
keep going on daily life like this never took place and you are never going 
to hear back again from me.

You will make the payment through Bitcoin (if you do not know this, search 
for “how to buy bitcoin” in Google search engine).

BTC Address to send to: 1K6i3WoKdgUGdXz2mgRo9Zx8cyTTRYFytp 
[case-sensitive, copy and paste it]

If you are thinking of going to the law enforcement, well, this mail can not 
be traced back to me. I have dealt with my steps. I am just not looking to 
ask you for money a lot, I want to be rewarded. I have a specific pixel 
within this email, and now I know that you have read through this email. You 
now have one day in order to pay. If I do not receive the BitCoins, I will 
definately send out your video recording to all of your contacts including 
family members, colleagues, and so on. Nonetheless, if I do get paid, I’ll 
erase the video right away. This is a non-negotiable offer, and so please do 
not waste my time & yours by responding to this email. If you want evidence, 
reply with Yes and I will send your video recording to your 10 contacts.

Basically, the attackers don’t actually have video of you or access to your contacts, and they haven’t been able to install malicious code on your computer. In reality, they’re taking a password from a database that’s available online, sending it to you, and hoping you’re scared enough to believe their story and send them bitcoin.

Some scammers have even made over $US50,000 from the blackmail scheme, based on an analysis of bitcoin wallets, Bleeping Computer reported.

As Brian Krebs, a leading security journalist, writes, this scam is probably automated, meaning you haven’t been specifically targeted:

“It is likely that this improved sextortion attempt is at least semi-automated: My guess is that the perpetrator has created some kind of script that draws directly from the usernames and passwords from a given data breach at a popular Web site that happened more than a decade ago, and that every victim who had their password compromised as part of that breach is getting this same email at the address used to sign up at that hacked Web site.”

For now, the scammers seem to be using really old passwords, probably one you haven’t used in years. But as the scam develops, it’s quite possible they may use more up to date passwords from a fresh breach.

To keep yourself protected, it’s a good idea to

  • Use long and strong passwords
  • Get a password manager to ensure each account has a unique password (Roboform, LastPass or Avast Password Manager which is included with Avast CloudCare)
  • Turn on two-factor authentication on your important accounts

Also it is recommended you turn off or cover any web cameras when you’re not using them to prevent sex-based extortion schemes, even if this kind of scam ends up being a hollow threat.

And no matter what you do, don’t send bitcoin to the scammers.



Leave a Reply