Two of our clients recently received an email similar to the one below. The password reported in the email was one that they had actually used in conjunction with their listed email address.
FYI, there are sites out there on the ‘dark web’ that sell email address/password combos which have been hacked from various sites – Target, Experian, Yahoo, and a bunch of other big players have been hit. To see if your email address has been involved in any known hacks go to http://haveIBeenPwned.com and enter your email address. (Yes, some of my accounts are among those hacked. But the password has long since been changed, or it was a throw-away password.)
In both our clients’ cases the password was one they use for sites they don’t expect to return to – there’s little if any valuable data associated with the account and was probably just used for a one-time purchase. So they had little to worry about.
Here’s the email they received. My comments are in bold:
I greet you!
I have bad news for you.
06/28/2018 – on this day I hacked your operating system and got full access to your account XXXXXX@XXXXXX.com On that day your account (XXXXXX@XXXXXX.com) password was: XXXXXX
As mentioned above, the password was a low-security one only used on sites for one-time use. The scammer would not have been able to access the user’s computer or any other devices using that password.
It is useless to change the password, my malware intercepts it every time.
How it was:
In the software of the router to which you were connected that day, there was a vulnerability.
I first hacked this router and placed my malicious code on it.
When you entered in the Internet, my trojan was installed on the operating system of your device.
This is close enough to being believable that it could be easy to think you might be vulnerable. Enough to scare some people, which is the point.
After that, I made a full dump of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).
A month ago, I wanted to lock your device and ask for a small amount of money to unlock.
But I looked at the sites that you regularly visit, and came to the big delight of your favorite resources.
I’m talking about sites for adults.
I want to say – you are a big pervert. You have unbridled fantasy!
And here’s where it was plainly obvious that it’s only a scam. Both these clients are some of the least likely people I could imagine surfing adult sites!
After that, an idea came to my mind.
I made a screenshot of the intimate website where you have fun (you know what it is about, right?).
After that, I took off your joys (using the camera of your device). It turned out beautifully, do not hesitate.
Language here says ‘not a native english speaker’.
Hint: unless you frequently use your device’s camera, put a piece of tape over it. They also make little slider windows that you can put on it so you can easily make the camera available when you want – and useless when you’re not actively using it.
I am strongly belive that you would not like to show these pictures to your relatives, friends or colleagues.
I think $902 is a very small amount for my silence.
Besides, I spent a lot of time on you! I accept money only in Bitcoins. My BTC wallet: XXXXXXXXXXXX You do not know how to replenish a Bitcoin wallet?
In any search engine write “how to send money to btc wallet”.
It’s easier than send money to a credit card! For payment you have a little more than two days (exactly 50 hours).
Do not worry, the timer will start at the moment when you open this letter. Yes, yes .. it has already started!
After payment, my virus and dirty photos with you self-destruct automatically.
There’s no guarantee of that happening!
If you send them money, you’re immediately tagged as an easy mark, and your info will probably be sold to other scammers. There will be no end to the attempts to separate you from your money.
Narrative, if I do not receive the specified amount from you, then your device will be blocked, and all your contacts will receive a photos with your “joys”.
I want you to be prudent.
– Do not try to find and destroy my virus! (All your data is already uploaded to a remote server)
– Do not try to contact me (this is not feasible, I sent you an email from your account)
– Various security services will not help you; formatting a disk or destroying a device will not help either, since your data is already on a remote server.
P.S. I guarantee you that I will not disturb you again after payment, as you are not my single victim. This is a hacker code of honor.
Pffft! There is no such thing as a ‘hacker code of honor!
From now on, I advise you to use good antiviruses and update them regularly (several times a day)!
Probably the only useful statement in this whole scam!
Don’t be mad at me, everyone has their own work.
Don’t fall for these scams! If you’re unsure, ask someone knowledgeable and honest for assistance.