Bitdefender has observed a phishing campaign that tries to blackmail users into sending money by claiming their computer has been hacked. The emails contain real passwords that have been leaked, in order to convince the recipient that the claims are legitimate.
“In this case, spammers attempt to fool recipients by referring to old passwords and existing email addresses, most of which have already been exposed online,” Bitdefender says. “The perps specify that login credentials to your online accounts were purchased from the web and used to install malicious software and spyware on your device. They use scare tactics to induce a sense of panic in recipients, threatening to expose a video montage containing lewd scenes of victims watching adult videos online to friends and family.”
The researchers note that this technique isn’t new, but the scale of the campaign is significant.
“The attacks spread across the globe, with unusually high numbers of spam emails reaching users in Romania (over 400,000 emails), Italy and the Netherlands,” the researchers write. “The messages originate from multiple IP addresses in Europe, Asia, Africa and the Americas. It seems they've been distributed in masses via a large spam botnet controlled by the same threat group.”
Bitdefender offers the following recommendations for users:
- “Stay calm and analyze the situation – even if the email includes your password, it was likely gathered from previous data breaches and leaks. If the scammer says your system is already infected with malicious software and spyware, why would he need you to personally transfer the ransom amount? He could easily harvest all of your account passwords and start draining your financial accounts?
- “Review and update your account passwords regularly
- “Never respond to threatening messages by asking the perps to provide you with a different payment method; report them to local authorities instead
- “Install a local security solution on your devices
- “Enable two-factor or multi-factor authentication”
New-school security awareness training can give your users a healthy sense of suspicion so they can avoid falling for these attacks.
Bitdefender has the story.
Here's how it works:
