Sextortion Scam Combines Lust and Envy

iStock-1139600307A sleazy phishing campaign is trying to tempt people into opening an attachment that supposedly contains nude pictures of a friend’s girlfriend, BleepingComputer reports. The attackers claim to have hacked the friend’s account and demanded five hundred dollars in return for not releasing the photos.

“We have got access to the e-mail account of one man, and you’re in his contact list,” the email says. “In this contact list, we have found images of his naked girlfriend and demanded five hundred dollars for them. In the event that he will ignore us, we guaranteed him that we will send these photos to everyone of his contacts. Regrettably, he has not paid, and because you were on his contact list, you obtained this mail. You will find these pix attached to this message.”

The email contains a Word document which, when opened, displays a blurred image. Above the image are instructions that tell the recipient to click the “Enable content” or “Enable editing” buttons in order to view the image. Clicking these buttons will allow the document to run a macro that will download the Racoon information-stealing malware.

BleepingComputer explains that this campaign uses a different social engineering tactic than typical sextortion scams that use threats and intimidation to get the victim to do what they want.

“By promising to deliver photos of a friend's naked girlfriend, the scammers appeal to the curiosity of their targets which, in many cases, might be a more successful method of incentivizing them to open a malicious attachment than making threats,” BleepingComputer writes.

So that’s two of the Seven Deadly Sins. If we look closely enough, we’ll probably be able to find pride, gluttony, avarice, rage, and sloth, too.

Setting aside the moral implications of trying to view private photos of your friend’s girlfriend (or of anyone else for that matter), anyone who knows the risks associated with opening unsolicited documents should immediately recognize this as a scam. Clicking “Enable editing” in a Microsoft Office document should be an even more blatant warning sign. New-school security awareness training can enable your employees to spot these red flags.

BleepingComputer has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Has Gone Nuclear Webinar

Get the latest about social engineering

Subscribe to CyberheistNews