In 2020, an advisory warning had been issued by The Indian Computer Emergency Response Team (CERT-In) about a new email extortion fraud. The advisory stated that the scammers have been sending false emails to people claiming that their computers have been hacked.
As a clarification to the claim of computers being hacked, the email says that a video has been recording using their webcam, and reveals that their passwords have been leaked. Further, as proof, the hackers display evidence of computers or email accounts that have been hacked at some point in time, which might contain your old passwords. Thus, they proceed to ask you for money in the form of Bitcoins or any other form of payment that cannot be traced. The hackers also issue a threat to leak personal information in public if refused to pay.
Hindustan Times reported, “As per the CERT-In advisory, although the listed passwords, shown as evidence that your account is hacked could be actual passwords that you used in the past, the attacker does not know them by hacking your account, but rather through leaked data breaches shared online.”
The advisory stressed that these circulating emails are malicious, and hence should not be trusted. "Recipients should not send any payments to the scammers. If the passwords listed are in use or familiar, recipients are advised to change the password at any site that they are being used," the advisory stated.
How do these generic emails from hackers look like?
To begin with, the hacker will try to trap the user by highlighting their old passwords in the email. This would appear similar to this format:
"I know, xxx, is your password. You don't know me and you're thinking why you received this email, right?"
Post this, the scammer would send a backstory mixed with computer jargon to make it sound professional and give validity that the scammer is a skilled hacker and this is a legitimate email from him/her.
This would appear similar to this format:
"Well, I actually placed a malware on the porn website and guess what, you visited this web site to have fun (you know what I mean). While you were watching the video, your web browser acted as a RDP (Remote Desktop) and a keylogger which provided me access to your display screen and webcam. Right after that, my software gathered all your contacts from your Messenger, Facebook account, and email account."
The next part in the email could be the final step before asking for ransom, hence the scammer would claim possession of personal video(s)by compromising the recipient's webcam in an attempt to scare the recipient. This would appear similar to this format:
"What exactly did I do?
I made a split-screen video. First part recorded the video you were viewing (you've got a fine taste haha), and the next part recorded your webcam (Yep! It's you doing nasty things!). "
Hence finally, the scammer will demand ransom in the form of Bitcoin (BTC), which could look the following:
"What should you do?
Well, I believe, $1900 is a fair price for our little secret. You'll make the payment via Bitcoin to the below address (if you don't know this, search "how to buy bitcoin" in Google).
(It is cAsE sensitive, so copy and paste it) "
Lastly, a deadline of 24hrs would be issued in the email and the scammer would state that if not complied with making the payment, he/she would release the videos in public
You have 24 hours in order to make the payment. (I have an unique pixel within this email message, and right now I know you have read this email). If I don' get the mayment, I will send your video to all your contacts including relatives, coworkers, and so forth. Nonetheless, if I do get paid, I will erase the video immediately. If you want evidence, reply with "Yes!" and I will send your video recording to your 5 friends. This is a non-negotiable offer, so don't waste my time and yours by replying to this email."
How do you deal with a scam email of this kind?
The CERT advisory clearly stated, "These emails are fake, scams, and nothing to worry about."
Thus, when you receive an email of this kind, it is important to not panic or get intimidated and pay any kind of ransom via any mode. If you feel any of the passwords shared by the scammer show any resemblance to the ones you have, immediately change your passwords. All in all, it is crucial to not reveal any kind of sensitive personal information on the internet in public and keep a check on your security control to avoid any kind of scamming.