The Year Targeted Phishing Went Mainstream

ronjor · Aug 2, 2018

A story published here on July 12 about a new sextortion-based phishing scheme that invokes a real password used by each recipient has become the most-read piece on KrebsOnSecurity since this site launched in 2009. And with good reason — sex sells (the second most-read piece here was my 2015 scoop about the Ashley Madison hack).
Click to expand...

https://krebsonsecurity.com/2018/08/the-year-targeted-phishing-went-mainstream/

Minimalist · Aug 26, 2018

Who’s Behind the Screencam Extortion Scam?

The sextortion email scam last month that invoked a real password used by each recipient and threatened to release embarrassing Webcam videos almost certainly was not the work of one criminal or even one group of criminals. Rather, it’s likely that additional spammers and scammers piled on with their own versions of the phishing email after noticing that some recipients were actually paying up. The truth is we may never find out who’s responsible, but it’s still fun to follow some promising leads and see where they take us.
Click to expand...

https://krebsonsecurity.com/2018/08/whos-behind-the-screencam-extortion-scam/

guest · Sep 10, 2018

Sextortion – When Persistent Phishing Pays Off
September 6, 2018
https://www.digitalshadows.com/blog-and-research/sextortion-when-persistent-phishing-pays-off/

You may have heard of a recent surge in sextortion-based phishing campaigns. These campaigns seek to extort victims by threatening to publicly embarrass them for engaging in a sexually-explicit act, using previously-exposed passwords as proof of compromise. [...] However, the recent scale and persistence of this campaign has led to some success.
Persistence pays off
These sextortion phishing campaigns seem easy enough to detect and dismiss, so it may seem unlikely that victims will pay the ransom. Over a period of two months, we detected more than 60,000 emails sent using this approach.

With 8,497 victims targeted by over 60,000 emails in our sample, it’s no surprise we identified some success. Of all the Bitcoin addresses detected in this sample, 26 transactions matching the demands were made, totaling $28,000.
Summary
While this sample set represents a small percentage of the total recipients of these sextortion campaigns, it’s clear that attackers are turning to new ways to monetize breached credentials.
Click to expand...

guest · Oct 31, 2018

Sextortion is back and this time it looks personal
October 31, 2018
https://betanews.com/2018/10/31/sextortion-this-time-personal/

Researchers at the Cisco Talos threat intelligence group have today released the results of their analysis of these attacks. One campaign began on August 30, and a second campaign began on October 5, both are still active

The researchers find that more than half of them originate from just five countries. Vietnam accounts for 15.9 percent, Russia 15.7 percent, India 8.5 percent, Indonesia 4.9 percent and Kazakhstan 4.7 percent.

Some variants of the messages have used phone numbers rather than passwords as the convincer, but the basics of the campaign remain the same. Other variations include threatening to disclose supposed evidence of cheating on a partner, or offering to sell evidence of a partner cheating on you.

You can read more about the scams and how they work on the Talos blog.
Click to expand...

guest · Feb 2, 2019

Sextortion Scam Stating Xvideos Was Hacked to Record You Through Webcam
February 2, 2019
https://www.bleepingcomputer.com/ne...deos-was-hacked-to-record-you-through-webcam/

A sextortion scam variant is going around that states the popular adult site called Xvideos.com was hacked to include malicious script that records a visitor through their webcam and sends it to the hacker. The scam emails also states that this script was able to connect back to the visitors computer to steal their data and contacts.

This is, though, the first time we have seen one using the hacked adult site angle and it seems to be working as the user was concerned it may be real.
As these scams have been extremely profitable, with attackers earning as much as $50k in a week with little or not cost to spam them out, we should not expect to see them stop any time soon.
Click to expand...

guest · Feb 8, 2019

Sextortion Scam Now With Malicious Downloader
February 6, 2019
https://www.trustwave.com/en-us/res...extortion-scam-now-with-malicious-downloader/

Compared to previous spams, the email body contains just a small snippet of the sextortion – a claim that the sender hacked and had access to the recipients’ photos, videos, contacts, and camera recordings. To make it more believable, the attackers attached an archive which serves as “proof” to their claim.

The PDF file “personalmente.pdf” contains the details of the sextortion. The text of the ruse suggests that through malware installed on the recipient’s computer, the hackers were able to gain access to data, and, that the recipient should pay bitcoins to the sender to not release the captured video.
The second file in the archive is an obfuscated JavaScript. This file will silently run a PowerShell command to download an executable file, save it to the temp folder, and execute it.

This one takes it a step further and includes a malware that serves as a door for other malware to be installed in the computer. If you happen to get one in your inbox, ignore it, and chances of it being real are remote.
Click to expand...

guest · Feb 28, 2019

Threat Spotlight: Sextortion
February 28, 2019
https://blog.barracuda.com/2019/2/28/threat-spotlight-sextortion/

Beware: These blackmail scams are increasing in frequency, becoming more sophisticated, and bypassing email gateways.

A recent analysis of spear phishing attacks targeted at Barracuda customers found that 1 in 10 were blackmail or sextortion attacks. In fact, employees are twice as likely to be targeted in a sextortion scam than a business email compromise attack.
Here’s a closer look at the research, more details about sextortion scams, and ways to protect your business from this type of blackmail threat. [...]
Click to expand...

guest · Mar 11, 2019

New "Final Warning" Sextortion Emails State Adult Sites Infected You
March 11, 2019
https://www.bleepingcomputer.com/ne...ortion-emails-state-adult-sites-infected-you/

A new sextortion email campaign is underway that states a hacker infected the recipient's computer while they were visiting an adult web site. The email goes on to say that this infection created a video using the computer's webcam while they were on the site and will be sent to family and friends unless an extortion payment is made.

This particular sextortion campaign appears to have started today and uses an email subject of "This is my final warning" and states that the recipient has 72 hours to send a $2,000 payment in bitcoins or a video will be released to their family and friends.
The full text of this sextortion scam is displayed below. [...]

Once again, this is a scam and numerous people have already reported to me that they have received this email today. Security researchers have also reported receiving numerous emails with the same subject lines.
Click to expand...

guest · Mar 19, 2019

I didn’t see what you did, redux
Cyberblackmail/sextortion again raises its not-so-pretty little head
March 19, 2019
https://www.welivesecurity.com/2019/03/19/i-didnt-see-what-you-did-redux/

When we wrote about this scam before, it was a case of “teach you to recognize a particular phish, and you’ll be safe from that specific attack”; today and in a few follow-up posts, I’ll try to teach you to recognize all phishes, so you’ll be safe from any similar attack. [No, technically these aren’t phishing attacks, but they do try to extract money from their intended victims, so: “close enough.” Maybe we’ll do a series on recognizing actual phishes in future posts.]

Since the scammers are always rolling out new traps to try to ensnare their intended victims, this will be a process that needs regular updating; indeed, to cover all I want to discuss and not make it into War and Peace, I’m breaking this discussion up into more-easily digested sections. This may be an ongoing project for Vox, so let’s get started.
Click to expand...

guest · Apr 3, 2019

CIA Porn Extortion Scams Now Use Password Protected PDFs
April 3, 2019
https://www.bleepingcomputer.com/ne...ortion-scams-now-use-password-protected-pdfs/

Last month we covered how the CIA exortion scam variant had started to become widely distributed. These scam emails pretend to be from a CIA technical collection offer who states that your name is part of an investigation into underage pornography. For a fee, though, they would be willing to wipe your information from the case files.

This latest variant is now utilizing password protected PDF attachments [...] Included in the email is the password for the attached PDF file.
Once the password is entered, the PDF will open and display instructions to send $5,000 USD to the enclosed bitcoin address.

It is important to stress that no matter how scary these emails may appear, they are just scams, numerous people have reported receiving them, the CIA is not investigating you, and you should not make any payments to the listed bitcoin addresses.
Click to expand...

guest · Apr 4, 2019

Fake CIA Sextortion Scam Uses SatoshiBox
April 4, 2019
https://www.trustwave.com/en-us/res...log/fake-cia-sextortion-scam-uses-satoshibox/

Another round of sextortion scam emails with a pdf attachment were pushed out recently claiming to be from the Central Intelligence Agency (CIA). What's new in this batch of spams is that this is the first time we have seen the scammers use an online web platform in collecting the ransom.

SatoshiBox is a web-based platform wherein files can be bought and/or sold for Bitcoins. The seller must upload the file to the server, set its price in dollars, and provide the Bitcoin address where the profit will be sent. SatoshiBox will then provide the Bitcoin equivalent of the file’s price and generate a unique Bitcoin address in which the buyer must use. The file can be downloaded, and the seller will get his profit once the payment is done. The buyer has no way of previewing the content of the file other than purchasing it.

In this scam, the supposed evidence “Personal-22232019.zip” is hosted in SatoshiBox.com. Once “BUY for $500” button is clicked, the equivalent Bitcoin value of $500 and the newly generated Bitcoin address will pop up. Note that in the pdf attachment, the scammer is asking for $5000 ransom whereas the value of the evidence posted is only $500.
Click to expand...

guest · Apr 5, 2019

4 Reasons Why You Receive Sextortion and Other Email Scams
April 5, 2019
https://sensorstechforum.com/4-reasons-receive-sextortion-email-scams/

Have you received a sextortion email? If yes, you must have wondered how the spammers obtained your email address. Here are four reasons for that sextortion email in your inbox.
Q: Why Do I Receive Spam Blackmail Emails? Why Do Spammers Have My Email Address?
A: Your email was breached.
Several huge data breaches occurred in the span of a couple of years. Let’s take the Yahoo data breach. In 2017, the company finally admitted that its data breaches compromised 3 billion accounts. Other major breaches [...]
A: Your email was spoofed. Such scams usually claim that the recipient’s email was hacked, and that’s why the email appears to be sent from it.
A: Your email address was harvested.
Did you know that the process of collecting email addresses in large-scale amounts is called email harvesting? Email harvesting can be done via different methods but the purpose is usually the same – to use collected data for spamming or sending bulk emails.
A: Your computer was infected.
This option should not be overlooked, especially if you have opened a suspicious email attachment or clicked on an unknown link. Phishing can lead to various outcomes, including the exposure of personal accounts.
Click to expand...

JRViejo · Apr 5, 2019

1) Started your Ƈamera and begun recoding you,
uploading the footage to my server…
Click to expand...

Have received quite a few of them, however, I don't have a camera so... how did they start recording?

guest · Apr 12, 2019

Sextortion Scammers Change Tactics to Bypass Spam Protection
April 12, 2019
https://www.bleepingcomputer.com/ne...ers-change-tactics-to-bypass-spam-protection/

Low paydays in the first trimester of the year have prompted scammers in the sextortion email business to switch to new tricks to restore the revenue stream of the not too distant past.
Between August 30 and October 5 last year, operators of the 'Aaron Smith' sextortion email campaigns made almost 150,000 in bitcoin (~23 BTC) from victims. Since the beginning of 2019, profits decreased to about $17,000 (~3.5 BTC).
Bag of tricks
A deeper analysis of the message reveals a more complex underlying code that mixes plain text letters with HTML character entities.
Researchers at Cisco Talos say that such a trick is not guaranteed to evade spam detection completely, though.

As such, the scammers turned the page in their book of tricks to a method that's been known since 2005: embedding images of the message in the email body.
By doing so, the anti-spam protection mechanism has little information to asses.
Click to expand...

guest · Apr 24, 2019

New Sextortion Scheme Demands Payment in Bitcoin Cash
April 24, 2019
https://www.trendmicro.com/vinfo/us...ortion-scheme-demands-payment-in-bitcoin-cash

The spam emails are also notable in that the hackers are now also using Bitcoin Cash as one of their preferred cryptocurrencies. The use of a Bitcoin Cash address likely just serves as an alternative, as other sextortion schemes that the researchers observed still use Bitcoin wallet addresses.

The spam email’s modus is simple. The hacker claims to have hijacked the recipient’s device as well as social media and email accounts. The hacker further claims to have supposed recordings of the recipient watching pornography and the websites the victim supposedly visited at the time.
Also of note is the actual content of the spam email. It doesn’t appear to be written by a native Italian speaker. The fraudsters most likely used a translation application.

Fraudsters also profit from their victim’s fears by posing as a government agency to intimidate them into forking over bitcoins. Other scammers combine sextortion with threats like ransomware and Android malware.
Dealing with sextortion scams can be tricky given the purposefully sensitive nature of this threat.
Click to expand...

guest · May 6, 2019

New Extortion Email Scam Threatens to Release Your Sex Tape
May 5, 2019
https://www.bleepingcomputer.com/ne...mail-scam-threatens-to-release-your-sex-tape/

In a new email scam campaign going around, extortionists are stating that they had intercourse with you a long time ago and had secretly recorded it. They then state that they stole all of your passwords and contact lists while you were in the bathroom.
The email goes on to say that if you send them $1,500 in bitcoins, they will delete everything they have about you and you will never hear from them again.

The good news is that people are not falling for it and the bitcoin address associated with the above email had not received any payments as of today. Unfortunately, we cannot provide this bitcoin address due to privacy concerns of the person who shared the above email with BleepingComputer.
While receiving one of these emails can be anxiety provoking, always remember that these are just scams and you should not believe anything they state.
[7quote]
Click to expand...

guest · Jun 13, 2019

Cybercrooks using text-based images in phishing emails to bypass spam filters
June 13, 2019
https://portswigger.net/daily-swig/...ges-in-phishing-emails-to-bypass-spam-filters

In a recent security alert, HKCERT said it has received “scores of reports of ransom emails” informing users that their devices have been compromised by malware – specifically a remote access trojan (RAT) – that allowed the hackers to record their activities online.
Unless a ransom is paid, the attacker says a video clip of the victim browsing adult websites will be released.

“In some cases, the senders went as far as to say that they had complete control of the recipients’ computers and their malware could evade the detection of antivirus software,” the alert reads.
In reality, however, there is no evidence that any of the victim’s devices had been compromised.

Growing evidence of the use of text-based images and QR codes in phishing emails shows that hackers are going to increasing lengths to maximize the distribution of their illicit campaigns.
Click to expand...

guest · Jun 18, 2019

Email sextortion scams are on the rise and they’re scary — here’s what to do if you get one
June 17, 2019
https://www.cnbc.com/2019/06/17/email-sextortion-scams-on-the-rise-says-fbi.html

Last year, electronic extortion complaints rose 242% to 51,146 reported crimes, with total losses of $83 million.
“The majority of extortion complaints received in 2018 were part of a sextortion campaign in which victims received an email threatening to send a pornographic video of them or other compromising information to family, friends, coworkers, or social network contacts if a ransom was not paid.”

“First, have a healthy level of skepticism,” said Malwarebytes CEO Marcin Kleczynski.
“Then, remember, they almost certainly haven’t been recording you or have access to this type of information, if it even exists.”
What you can do
Besides having a healthy level of skepticism -- it is highly, highly unlikely anyone sending one of these emails knows you or has information on you, Kleczynski emphasises -- checking and updating your spam filters can also help, to make sure those filters are catching the latest versions of these scams.
Click to expand...

guest · Jul 10, 2019

“Sexfavor” Email Scam Delivers Danabot
July 9, 2019
https://www.trustwave.com/en-us/res...bs-blog/sexfavor-email-scam-delivers-danabot/

Sextortion has been a widely used theme in spam campaigns since Q1 of 2018. From simple crafted emails containing just plain text, extortion scams have evolved – even to the point of adding malicious attachments in Q1 of 2019. Since then, we’ve seen more and more attackers use sextortion spam emails as the arrival vector of their malware.

Now it seems the people behind Danabot, a notorious banking trojan, are trying out a different theme in their email campaigns – and quite the opposite of extortion. Instead of threats, the email body contains enticing text about sexual favors.
The ruse goes like this: because of the sender’s unfavourable circumstances, they are asking for bitcoins as financial support in exchange for sexual videos and/or photographs. In addition, as referred to in paragraph 2 of the email body, the sender has attached “personal video clips” to lure the email recipient into clicking.
Click to expand...

guest · Jul 30, 2019

Sextortion Email Scams Rise Sharply
July 30, 2019
https://www.darkreading.com/attacks-breaches/sextortion-email-scams-rise-sharply/d/d-id/1335377

Email scams in which cybercriminals attempt to extort money from victims by threatening to reveal something embarrassing about them are on the rise.
According to Symantec, between January and the end of May this year, it blocked some 289 million scam emails, many of them involving so-called "sextortion" attempts.

The scam emails often include passwords and phone numbers recipients may have used or are currently using to give the impression the attackers have access to a lot of their personal information. The goal is make users fear their computers might have actually been hacked and used to observe potentially compromising actions.

For the most part, sextortion scams are consumer-focused. But reports about attackers using spear-phishing emails to target individuals in corporate settings have come out as well.
Though sextortion scams are twice as likely as business email scams in a corporate setting, they are often under-reported because of the intentionally embarrassing and sensitive nature of the content, Barracuda discovered.
Click to expand...

guest · Jul 30, 2019

mood said: ↑

Sextortion Email Scams Rise Sharply
July 30, 2019
https://www.darkreading.com/attacks-breaches/sextortion-email-scams-rise-sharply/d/d-id/1335377
Click to expand...

Symantec: The Revival and Rise of Email Extortion Scams

When we look at the number of these kinds of scams that have been blocked by Symantec since the start of this year, we can see the trend is going upwards, with a spike visible during a two-week period in February especially notable.

Between January 1 and May 29, 2019, just under 289 million of these types of emails were blocked by Symantec technologies. Just over 85 million of these emails (almost 30 percent) were blocked during this 17-day period in February when we saw a big spike in these types of scams.
Are these scams successful?
If we take that as an average amount to make in a 30-day period for these kinds of scams, it means they are making just over US$1.2 million in a year ($1,292,586). For the amount of effort and skill that is required to carry out these scams, it represents a pretty good return on investment.
Click to expand...

guest · Aug 5, 2019

Cofense Labs Publishes Database of Over 200 Million Compromised Accounts Targeted by Sextortion Email Campaigns
August 5, 2019
https://cofense.com/cofense-labs-pu...accounts-targeted-sextortion-email-campaigns/

CofenseTM, the global leader in intelligent phishing defense solutions, today published a database of over 200 million compromised accounts being targeted by a large sextortion scam to ensure potential victims and their employers can address the threat of sextortion and prevent lost wages and productivity.

Cofense Labs, the newly formalized research and development arm of Cofense, discovered a “for rent” botnet in June 2019 used primarily to send sextortion emails. The research team is monitoring the botnet’s activity on a daily basis to observe changes in the malware it is spreading as well as tracking new email addresses being targeted for sextortion phishing emails.
Click to expand...

guest · Aug 10, 2019

OPP Norfolk warn residents about porn extortion scam
August 8, 2019
https://www.cbc.ca/news/canada/hamilton/opp-norfolk-pornography-email-extortion-scam-1.5239898

After being contacted by a victim, provincial police in Norfolk County are investigating a pornography extortion scam.
The victim told police that the email said her accounts had been hacked and that the sender had her passwords. She also said that the sender was aware of the adult pornography websites that she had visited; if she refused to forward a quantity of bitcoin, pictures and video of the websites she visited would be forwarded to everyone in her contact list.

The victim realized that the email was a scam and immediately contacted police.
Police say that these emails are designed to create anxiety in order to shock people into sending money.

"These types of messages are commonly known as scareware," said OPP. "If you receive one of these messages, please be aware that this is a scam."
Police say that if you've received such an email or if you have been locked out of your computer, your computer might have been infected with malware.
Click to expand...

They listed tips to protect yourself from email scams:

Never download anti-virus software from a pop-up or link sent to you through an e-mail.

Update your anti-virus software often and scan your computer for viruses regularly.

Don't click on links or attachments in e-mails sent to you by someone you don't know.

Turn on your browser's pop-up blocking feature.

Never click on a pop up that claims your computer has a virus.

Click to expand...

Minimalist · Aug 11, 2019

Phishing tricksters nab the warm fuzzies, smiles

Phishing is the most common form of cyberattack and still growing. Yet, in a survey of Internet users, it was found that 45 percent of those surveyed did not understand what phishing was or the risk associated with it.
Click to expand...

https://techxplore.com/news/2019-08-phishing-tricksters-nab-fuzzies.html

Minimalist · Aug 13, 2019

Phishing is the top security threat for businesses

A security service developed by the telecommunications firm Telefónica, in collaboration with McAfee and Allot, has revealed that the majority of the threats (89%) it has blocked so far are related to phishing.
Click to expand...

https://www.techradar.com/news/phishing-is-the-top-security-threat-for-businesses

Log in or Sign up

The Year Targeted Phishing Went Mainstream

ronjor Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

JRViejo Super Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

The Year Targeted Phishing Went Mainstream

ronjor Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

JRViejo Super Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Useful Searches