A sleazy phishing campaign is trying to tempt people into opening an attachment that supposedly contains nude pictures of a friend’s girlfriend, BleepingComputer reports. The attackers claim to have hacked the friend’s account and demanded five hundred dollars in return for not releasing the photos.
“We have got access to the e-mail account of one man, and you’re in his contact list,” the email says. “In this contact list, we have found images of his naked girlfriend and demanded five hundred dollars for them. In the event that he will ignore us, we guaranteed him that we will send these photos to everyone of his contacts. Regrettably, he has not paid, and because you were on his contact list, you obtained this mail. You will find these pix attached to this message.”
The email contains a Word document which, when opened, displays a blurred image. Above the image are instructions that tell the recipient to click the “Enable content” or “Enable editing” buttons in order to view the image. Clicking these buttons will allow the document to run a macro that will download the Racoon information-stealing malware.
BleepingComputer explains that this campaign uses a different social engineering tactic than typical sextortion scams that use threats and intimidation to get the victim to do what they want.
“By promising to deliver photos of a friend's naked girlfriend, the scammers appeal to the curiosity of their targets which, in many cases, might be a more successful method of incentivizing them to open a malicious attachment than making threats,” BleepingComputer writes.
So that’s two of the Seven Deadly Sins. If we look closely enough, we’ll probably be able to find pride, gluttony, avarice, rage, and sloth, too.
Setting aside the moral implications of trying to view private photos of your friend’s girlfriend (or of anyone else for that matter), anyone who knows the risks associated with opening unsolicited documents should immediately recognize this as a scam. Clicking “Enable editing” in a Microsoft Office document should be an even more blatant warning sign. New-school security awareness training can enable your employees to spot these red flags.
BleepingComputer has the story: https://www.bleepingcomputer.com/news/security/malware-spread-as-nude-extortion-pics-of-friends-girlfriend/
Here's how it works:
