[chris (OP)]

Just to make everyone aware, in case some people are at risk of falling victim to this, there is a particularly nasty malicious email scam currently being operated.

The message arrives from a range of names, including "Stefan" and "Jim Grodberg", who introduce themselves by announcing that they know your password, and they say what it is.

The mail then goes on to say that they hijacked your computer while you were looking at an adult site and used your computer's webcam to film what you were up to as you viewed.

The message ends by instructing you to send several thousand Dollars worth of bitcoins to an address within 24h or they will email a video of you, together with what you were watching, to all of your contacts.

However, do not be alarmed - THIS IS A SCAM. It is given authenticity by the inclusion of the password at the message opener, but many people are commenting that the passwords they see printed are indeed passwords they have used, but a long time ago.

This is the clue to what is going on here. The senders of these emails are using passwords and email addresses stolen during historical data breaches to add extra credibility.

Incredibly, some people must have been looking at a lot of porn, because tracking a handful of the bitcoin addresses being used shows that the scam has already netted the senders at least $50k this week.

At the Naked Scientists we have received a few of these mails; here is what they look like:

{PASSWORD} is your Password. I won't beat around the bush. You do not know anything about me whereas I  know alot about you and you're probably thinking why you're getting this e mail, correct?

You may be thinking "how?", I setup malware on sex vids (porn) and do you know what, you accessed this porn website to experience fun (know what I mean?). When you were busy watching video clips, your web browser started out working as a RDP (Remote Control Desktop) having a key logger which provided me with accessibility to your screen and your camera controls. After that, my software program gathered all of your contacts from messenger, facebook, and mailbox.

What have I done?
It is simply your misfortune that I stumbled across your blunder. I then invested in more days than I should have looking into your data and generated a double screen video. 1st half shows the video you were viewing and next part displays the video from your cam (its someone doing dirty things)

What can you do?
Honestly, I'm ready to forget all about you and allow you to get on with your regular life. And I will present you a way out that may achieve it. The two options are either to ignore this e mail (not recommended), or pay me $2900 to finish this mattter for life. Let’s explore these two options in depth.

First Choice is to turn a deaf ear this email. You should know what is going to happen if you opt this option. I will send your sextape to all of your contacts including family members, colleagues, etc. It does not shield you from the humiliation your family will must feel when friends uncover your sordid videotape.
Other Option is to send me $2900. We will call it my “keep the secret charges”. Now Lets discuss what will happen if you pick this path. Your secret Will remain your secret. I'll erase the videotape. After you make the payment, I will let you move on with your daily life and family as if nothing like this ever happened.

You will make the payment via Bitcoin (if you don't know this, type "how to purchase "bitcoins" in search engine)
My BTC Address: 14VKMR13H67yVwUftEWYZfje1ruBS6k6d5
(It is case sensitive, so copy and paste it carefully)

Important: You now have one day to make the payment. (I've a special pixel in this email, and now I know that you've read this mail). DO NOT TELL anybody what you will use the Bitcoins for or they possibly will not offer it to you. The task to get bitcoin will take a day or two so do not delay.
If I don't get the BitCoin, I will send your videotape to all of your contacts including friends and family, co-workers, and many others. however, if I receive the payment, I will erase the sextape immediately. If you want to have evidence, reply with "yes!" and I will send your video recording to your 11 contacts. It is a non negotiable one time offer, so kindly do not ruin my time & yours by replying to this email.

Please, be reassured; these nefarious operators do not have any video of you; this is purely a scam and has been reported to fraud agencies in a number of countries.

Things you should do if you receive one of these messages:

1) If the password they cite is one that you are still using, CHANGE YOUR PASSWORD.

2) Check out https://haveibeenpwned.com/ - this is a database of the passwords and email addresses stolen during known data breaches. It will flag up any sites that were compromised and were holding your data. This will warn you where to change your passwords.

3) Report the email to your relevant authority. Type "Report a cyber crime" into a search engine.

4) If anyone else receives  a message like that above, please reply to this thread and post yours here too so that we can keep track of what's been sent to people and give recipients some reassurance.

[chiralSPO]

Scary stuff...

Just one more reason to get (or improvise) a lens cap for your webcam. It's unhackable and practically free, and all you have to do is remember to take it off before your video conference starts (and then put it back in place before picking your nose, or singing along to Miley Cyrus, or *ahem* whatever else you would worry about being shared with the world...)

[chris (OP)]

Just one more reason to get (or improvise) a lens cap for your webcam.

I was thinking about this this morning; do people make gadgets that can strap on to existing laptops? I cannot easily see how one could add something like this to - say - my present laptop without a severe aesthetic consequence...

[evan_au]

I cannot easily see how one could add something like this to - say - my present laptop without a severe aesthetic consequence...

I use a square of Post-It note* over the camera. Cheap, easily removable, easily replaceable, and not too ugly!

And certainly a lot more secure than the traditional use of Post-It notes on computers - to record the login password...

*Other brands of self-adhesive notes are available...

[chris (OP)]

Here's the latest one to arrive today:

{PASSWORD} is one of your password now Let me get straight to the point. You do not know me whereas I know you very well and you must be thinking why you're receiving this e mail, right?

I actually placed malware on porn video clips (pornography) and you know what, you visited same porn website to experience fun (know what I mean?). When you were busy watching videos, your device started operating as a RDP (Remote Computer) that has a backdoor which provided me accessibility to your system and also your camera access. Immediately after that, the software gathered all your contacts from your messenger, social networks, as well as email.

What have I done?
It's simply your hard luck that I saw your bad deeds. I then put in more days than I probably should have exploring into your life and prepared a two view videotape. 1st part shows the recording you had been viewing and second part shows the recording of your web cam (its you doing inappropriate things). As a family man, I am ready to remove all about you and let you move on with your daily life. And my goal is to present you a way out that can make it happen. These two choices are to either ignore this email (bad for you), or pay me $1300 to close this mattter for life.

What should you do?
Let's examine these two options in more details. First Choice is to disregard my e mail. Let me tell you what is going to happen if you opt this option. I definitely will send out your video recording to all your contacts including friends and family, coworkers, and so forth. It doesn't save you from the humiliation your household will face when family and friends find out your unpleasant videotape. Wise choise is to make the payment of $1300. We will name this my "privacy charges". Lets see what happens if you select this choice. Your dirty secret Will remain your secret. I will destroy the recording. Once you pay, I will let you keep your lifetime and family that none of this ever happened. You'll make the transfer by Bitcoin (if you do not know how simply type "how to purchase bitcoins" on google)

My BTC Address: 1D7CiFnCrGsGdvtgZgGoYUApJ4vENwdmBm
(It's cASe SENSITIVE, copy and paste it carefully)

Important: You now have one day in order to make the payment. (I've a unique pixel in this email message, and at this moment I know that you've read through this message). You must not explain anybody what will you be sending the bitcoin for or they may not offer it to you. The process to get bitcoins usually takes a few days so do not delay. If I do not get the BitCoin, I definitely will send your videotape to all of your contacts including friends and family, coworkers, and so on. nevertheless, if I do get paid, I will destroy the videotape immediately. If you really want evidence, reply with "yes!" and I will send out your video to your 13 contacts. It's a non-negotiable one time offer, so please don't ruin my time and yours by responding to this e-mail.

So it's largely the same, except the English is still tragically poor, the price has gone down (must be getting desperate) and the number of people they'll send the "evidence" to has climbed to 13 now - unlucky for some...

[smart]

Thanks for sharing! I really appreciate... 

tk

[chris (OP)]

These people have been writing to us for about 2 weeks, each time giving us 24h to pay up before they mail all our contacts with compromising videos of us; in the same breath they counsel that it can take several days to lay your hands on the bitcoins.

No saucy videos sent to our contacts...yet. Do let us know if you receive a video of a naked scientist doing something really naughty, like opening an email, or making a radio programme...

Please don't fall for this anyone.

[guest39538]

These people have been writing to us for about 2 weeks, each time giving us 24h to pay up before they mail all our contacts with compromising videos of us; in the same breath they counsel that it can take several days to lay your hands on the bitcoins.

No saucy videos sent to our contacts...yet. Do let us know if you receive a video of a naked scientist doing something really naughty, like opening an email, or making a radio programme...

Please don't fall for this anyone.

I get loads of scammers in my email account, nothing like the thread topic though.  Everything from mystic megs to unmissable offers.  Most of them lead to bitcoin lol, be careful of the small print and lots of these scams, you get a click next option on some, if you click next they will charge you for sending you texts at Ł1.50 a text.  Be careful what you click on or to avoid anything like the thread topic, simply get a PC tower and do not have a web cam.   I ''play'' with these scammers, they are good fun to troll , I am sick of getting the bank scam .  I trolled them for ages lol, had them convinced I was going to fall for it ahahaha.   They were rubbing their hands ahahah until I dropped it on them.

[smart]

The most spectacular blackmail I received so far is this:

Daddy you didn't say what the most effective thing about God is.
You must play too.

Really not sure what that cryptic message is supposed to mean at all!   

tk

[RD]

...  I ''play'' with these scammers, they are good fun to troll , I am sick of getting the bank scam .  I trolled them for ages lol, had them convinced I was going to fall for it ahahaha.   They were rubbing their hands ahahah until I dropped it on them.

Here's the forum for you ... https://forum.419eater.com/forum/index.php

[guest39538]

...  I ''play'' with these scammers, they are good fun to troll , I am sick of getting the bank scam .  I trolled them for ages lol, had them convinced I was going to fall for it ahahaha.   They were rubbing their hands ahahah until I dropped it on them.

Here's the forum for you ... https://forum.419eater.com/forum/index.php

Thank you , that should be interesting.   

[chris (OP)]

They're back again today:

Hi, victim.
This is my last warning.
I writе yоu bеcаusе I рut a malware оn the web раgе with porn which you havе visited.
My virus grаbbеd аll your personаl infо аnd turned on your саmerа which саpturеd the process of yоur onаnism. Just aftеr thаt thе sоft saved your contаct list.
I will deletе thе соmpromising vidеo аnd infо if you раy mе 600 USD in bitсoin. This is address fоr рaymеnt : 1ML4nLW4tyVwa3dqhbwYRsHw4Tuiqy92W3
 
I givе you 30 hours аfter you ореn my mеssаgе for making thе transаctiоn.
As sооn as you reаd thе mеssagе I'll sеe it right awаy.
It is nоt neсessаry tо tell mе thаt you have sеnt money to me. This аddress is connесted to yоu, my systеm will delеtе everything automatically аfter transfеr соnfirmаtion.
If you nееd 48 h just reрly оn this letter with +.
Yоu cаn visit the роliсe stаtion but nоbоdy can hеlp you.
If you try to decеive mе , I'll see it right аway !
I dоnt livе in yоur сountry. Sо thеy саn nоt trасk my lосatiоn evеn for 9 mоnths.
Goоdbyе. Dоnt forgеt about thе shаmе and tо ignоre, Your life саn be ruined.

This one is from "e" - "admin@warheads2foreheadsproductions.com"

You'll note that the price is now even lower - we're down at US$600 now, so this appears to be bargain bucket porn guilt revenge. Clearly it's worth keeping the spammers waiting - the longer they wait the lower the price. At this rate they will be paying me!

More seriously, this message is almost certainly not written by the same group; it uses shoddy English, contains none of the plausibility of the first wave (that contained passwords for added authenticity) and has a totally different tone.

Amazingly, the "soft" also waited for the (presumably hard) viewer to have an "oanaism" before it saved their contact list. Clever - computer software that can remotely recognise the moment of an "oanism". Shame it still can't implement spellcheck really.

The most likely explanation is that this is a bunch of people piggy-backing off the idea of the first lot, who actually made themselves a reasonable amount of money out of frightened people who paid up.

Please don't fall for this scam. But also watch out for the websites you visit - many are now incorporating all kinds of nefarious code with consequences like cryptojacking...

[jeffreyH]

They probably have small members and feel inadequate. They need the blackmail money for their new 'extension'.

[smart]

They're back again today:

Hi, victim.
This is my last warning.
I writе yоu bеcаusе I рut a malware оn the web раgе with porn which you havе visited.
My virus grаbbеd аll your personаl infо аnd turned on your саmerа which саpturеd the process of yоur onаnism. Just aftеr thаt thе sоft saved your contаct list.
I will deletе thе соmpromising vidеo аnd infо if you раy mе 600 USD in bitсoin. This is address fоr рaymеnt : 1ML4nLW4tyVwa3dqhbwYRsHw4Tuiqy92W3
 
I givе you 30 hours аfter you ореn my mеssаgе for making thе transаctiоn.
As sооn as you reаd thе mеssagе I'll sеe it right awаy.
It is nоt neсessаry tо tell mе thаt you have sеnt money to me. This аddress is connесted to yоu, my systеm will delеtе everything automatically аfter transfеr соnfirmаtion.
If you nееd 48 h just reрly оn this letter with +.
Yоu cаn visit the роliсe stаtion but nоbоdy can hеlp you.
If you try to decеive mе , I'll see it right аway !
I dоnt livе in yоur сountry. Sо thеy саn nоt trасk my lосatiоn evеn for 9 mоnths.
Goоdbyе. Dоnt forgеt about thе shаmе and tо ignоre, Your life саn be ruined.

This one is from "e" - "admin@warheads2foreheadsproductions.com"

You'll note that the price is now even lower - we're down at US$600 now, so this appears to be bargain bucket porn guilt revenge. Clearly it's worth keeping the spammers waiting - the longer they wait the lower the price. At this rate they will be paying me!

More seriously, this message is almost certainly not written by the same group; it uses shoddy English, contains none of the plausibility of the first wave (that contained passwords for added authenticity) and has a totally different tone.

Amazingly, the "soft" also waited for the (presumably hard) viewer to have an "oanaism" before it saved their contact list. Clever - computer software that can remotely recognise the moment of an "oanism". Shame it still can't implement spellcheck really.

The most likely explanation is that this is a bunch of people piggy-backing off the idea of the first lot, who actually made themselves a reasonable amount of money out of frightened people who paid up.

Please don't fall for this scam. But also watch out for the websites you visit - many are now incorporating all kinds of nefarious code with consequences like cryptojacking...

Have you considered searching for the IP address of the sender in your logs and forward this blackmail to your authorities?

You may also want to block the IP address in your firewall to prevent further attempts like this.

tk

[syhprum]

Most people watch porn and or masturbate I would not be horrified at a video of me doing it was put out on the internet .
I certainly would not pay to avoid it happening I would call their bluff and ask them to show a sample of what they have (they of course have nothing!) which would shut them up

[chris (OP)]

I would call their bluff and ask them to show a sample of what they have

You probably shouldn't do that because then they will know that your email address is active and that you are actually reading their mail. Then they may target you more intensively in other ways, for instance with nasty attachments that can deploy toxic payloads at your machine when you open them. For instance, you might get a document that says something vague, like: "The pics you requested" or "Your document" - and although this looks to be a .doc or a .pdf file, it's actually an executable, and if you are operating your machine as admin (which heaps of people stupidly do for the convenience of not having to type in passwords to access various functions and updates) then the executable will happily run with admin privileges and hijack your machine, probably installing a back-door that you won't know about.

The best approach is to report the threat and make it public, like we are here, so that people can see that it's a hoax and to look out for it, and then put a block on the email of the sender, and then delete the source message.

Definitely do not send any response and do not open any attachments from these people. And definitely don't pay them, because then they know you are a pushover with a guilty conscience and they will never leave you alone...

[chris (OP)]

Cue the COPYCATS - here's the next generation of these exploitation emails; my one just arrived; here it is so you can see what they are saying this time. Sadly these scammers appear to have fallen on hard times and cannot afford a spellchecker or master a basic grasp of English. They've also neglected to realise that I don't actually own a webcam or have an active camera on any device I use. And maybe they're broke because they are asking such bargain basement prices - this lot want only $829 from me to spare me destruction of my reputation.

It goes without saying, of course, if you receive these, DO NOT PAY!

This is pure flannel; they have not hacked you; they have obtained an old password that you used to use for sites like Sony, TalkTalk, Adobe etc, all of whom have been hacked themselves in the past and had their user databases stolen and circulated, together with the passwords people used for those sites.

This exploit is gambling that, by mass-mailing huge numbers of people, some will use the same password for everything (bad idea) and will not have changed their password. These poor people will believe this and be tempted to cough up. Don't! Just hit the report as phishing scam button and delete it.

Hello!

I have very bad news for you.
03/08/2018 - on this day I hacked your OS and got full access to your account XXXX
On this day your account XXXX has password: XXXX

So, you can change the password, yes.. But my malware intercepts it every time.

How I made it:
In the software of the router, through which you went online, was a vulnerability.
I just hacked this router and placed my malicious code on it.
When you went online, my trojan was installed on the OS of your device.

After that, I made a full dump of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).

A month ago, I wanted to lock your device and ask for a not big amount of btc to unlock.
But I looked at the sites that you regularly visit, and I was shocked by what I saw!!!
I'm talk you about sites for adults.

I want to say - you are a BIG pervert. Your fantasy is shifted far away from the normal course!

And I got an idea....
I made a screenshot of the adult sites where you have fun (do you understand what it is about, huh?).
After that, I made a screenshot of your joys (using the camera of your device) and glued them together.
Turned out amazing! You are so spectacular!

I'm know that you would not like to show these screenshots to your friends, relatives or colleagues.
I think $829 is a very, very small amount for my silence.
Besides, I have been spying on you for so long, having spent a lot of time!

Pay ONLY in Bitcoins!
My BTC wallet: 18YDAf11psBJSavARQCwysE7E89zSEMfGG

You do not know how to use bitcoins?
Enter a query in any search engine: "how to replenish btc wallet".
It's extremely easy

For this payment I give you a little over two days (exactly 55 hours).
As soon as this letter is opened, the timer will work.

After payment, my virus and dirty screenshots with your enjoys will be self-destruct automatically.
If I do not receive from you the specified amount, then your device will be locked, and all your contacts will receive a screenshots with your "enjoys".

I hope you understand your situation.
- Do not try to find and destroy my virus! (All your data, files and screenshots is already uploaded to a remote server)
- Do not try to contact me (you yourself will see that this is impossible, I sent this email from your account)
- Various security services will not help you; formatting a disk or destroying a device will not help, since your data is already on a remote server.

P.S. You are not my single victim. so, I guarantee you that I will not disturb you again after payment!
This is the word of honor hacker

I also ask you to regularly update your antiviruses in the future. This way you will no longer fall into a similar situation.

Do not hold evil! I just do my job.
Good luck.

[chris (OP)]

This is the word of honor hacker

This has to be the best line in the whole thing... "Trust me, I'm a filthy charlatan seeking to blackmail you..."

[syhprum]

I checkout if I could change from administrator to standard but was told there must be at least one administrator account on the computer. 

[chris (OP)]

You absolutely need an admin account on the computer to control the config, but you also absolutely should not run the computer for day to day use while logged in as admin. Unless you have a death wish, or you really know what you are doing...