What the scam?!

Email scams! We’ve most likely all tried it and while most of the scams are easy to spot, there will be some that are less easy and more scary.

It might appear less scary if the email is sent from weiufgwefug@whateverbiz-lookinglikearealcompany.com – But what about when it is then sent from your own account? But is it really sent from your own account?

The fact that it shows your email in the “sent” field, doesn’t necessarily mean that it was indeed sent from your own account. This can be done with email spoofing and will appear as if it was sent from your own email.

In layman’s terms; imagine you’re the perpetrator, sending a package at the post office, but the address you put on the label, is also the return address, but neither address is your own.

Trending email scam.

A popular email scam at the moment is one where the perpetrator claims to have footage of you, in an intimate situation, while also having recorded what is on the screen. I have put the exact email below:

“Hello!

As you may have noticed, I sent you an email from your account.
This means that I have full access to your account.

I’ve been watching you for a few months now.

The fact is that you were infected with malware through an adult site that you visited.
If you are not familiar with this, I will explain.

Trojan Virus gives me full access and control over a computer or other device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.
I also have access to all your contacts and all your correspondence.

Why your antivirus did not detect malware?
Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent.
I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can send this video to all your emails and contacts on social networks. I can also post access to all your e-mail correspondence and messengers that you use.

If you want to prevent this, transfer the amount of $547 to my bitcoin address (if you do not know how to do this, write to Google: “Buy Bitcoin”).
My bitcoin address (BTC Wallet) is: *DELETED WHEN PASTED*

After receiving the payment, I will delete the video and you will never hear me again.
I give you 48 hours to pay.
I have a notice reading this letter, and the timer will work when you see this letter.

Filing a complaint somewhere does not make sense because this email cannot be tracked like my bitcoin address.
I do not make any mistakes.
If I find that you have shared this message with someone else, the video will be immediately distributed.

Best wishes!”

While this guy may seem nice, to add a little guide of how to add bitcoins to your account, and wishes you the best, he truly doesn’t have a clue. “Fun” fact: I have seen several attempts of this specific email type, and the BTC wallet is never the same.

How do they have my email though?

Unfortunately, there’s a chance that your email has been compromised on some other website, we’ll get back to that. This still doesn’t necessarily mean that they have access to your email account. This is why we never use the same password for several accounts, guys!! Imagine how many places you have used your email, typed it in a box and pressed submit + every email you’ve ever sent. For each time, there’s a risk that the email will fall into the hands of the wrong person.

Can never be too safe!

Just like you should wear safety glasses for New Years, you should also have an anti-virus installed along with anti-malware. I can highly recommend Bitdefender free and Malwarebytes Anti-Malware.

Sometimes you’ll need a bit more than just software to help you, as the software might not notice the breach, and won’t alarm until the malicious file is already in effect. Therefore you should also, always use 2-factor authentication (2FA)!

Is there a way to check if my credentials have been breached?

Glad you asked, yes indeed there is.

A huge shout out to https://haveibeenpwned.com/ ! If you go to their website, type in your email address, the website will look up your email and see if it has been breached/leaked. I, for one, had an account that got leaked due to the data breach on Dropbox, back in 2012.

Again, change your passwords, and enable 2FA!

I hope it shed some light on a scary situation 🙂

Good luck and take care out there!

Brian Lykke