# MA-707.102018: MyCERT Alert - Bogus Blackmail Scam Email

**Date:** 25 Oct 2018  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-707.102018  
**Advisory ID:** MA-707.102018

---

**1.0    Introduction**
MyCERT has been receiving several incidents recently targeting Malaysian internet user s with bogus blackmail scam email that demand victims payment in bitcoin. As a preventive measure, MyCERT release this alert to advise internet user in Malaysia to take necessary steps to secure their systems against unwanted incidents as well from other security threats.
**2.0    Modus Operandi**
Based on our investigation, cybercriminals send bogus emails to blackmail unsuspecting victims by claiming that they have cracked victim’s email account and their devices, and that they now have victims email account password. Moreover, cybercriminals claim that they have placed some malicious code in the operating system belonging to the victims, which gathered all the contacts and Internet browsing history of the victims, and, installed a Trojan as well. Cybercriminal also claim that they have recorded footage of the victims watching porn videos by activating their webcam when they visit these sites.
To prevent this footage from being sent to all of victims’ friends and colleagues, victims must pay certain amount of ransom in Bitcoins. Cybercriminals would warn victims that they have 48 hours to pay a ransom, otherwise they will spread the footages and block their devices.
An example of the scam email as below;
Figure 1: Bogus blackmail email sample
However, it has been confirmed that all of these claims by cybercriminals are not true, there is no disgraceful photo being recorded, or the device being hacked or installed with malicious code. Victims should simply ignore this threat or other similar emails that they get as cybercriminals would simply threaten victims for monetary purposes. However, as a precautious measure, victims may scan their devices with a reputable antivirus/anti-spyware to ensure that their devices are clean.
**3.0    Recommendation**
Attached below are some recommendations for internet users as preventive measures and mitigation steps against these attacks:
1.    Never send compromising images of yourself to anyone, no matter who they are or who they say they are.
2.    Don’t open attachments from people you don’t know, and in general be wary of opening attachments even from those you do know.
3.    Turn off [and/or cover] any web cameras when you are not using them.
4.    Scan the device with a reputable antivirus/anti-spyware to ensure that the device is clean.
5.    Report any such incidents or any enquiries 
Generally, MyCERT advises internet users to be updated with the latest security announcements by the authority and follow best practice security policies to prevent and mitigate the threat.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#7e1d071c1b0c4747473e1d071c1b0c0d1b1d0b0c170a07501307) or [[email protected]](/cdn-cgi/l/email-protection#137e6a70766167537e6a707661673d7c61743d7e6a)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 08:30 AM - 17:30 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**4.0 References**
•    <https://www.eff.org/deeplinks/2018/07/sextortion-scam-what-do-if-you-get-latest-phishing-spam-demanding-bitcoin>
•    <https://www.businessinsider.my/new-email-scam-uses-old-password-fake-porn-threats-webcam-video-bitcoin-2018-7/?r=US&IR=T>
•    <https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/>
•    <https://www.pcrisk.com/removal-guides/13912-hacker-who-cracked-your-email-and-device-email-virus>