# MA-785.042020: MyCERT Alert - Bogus Scam Email

**Date:** 15 Apr 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-785.042020  
**Advisory ID:** MA-785.042020

---

**1.0 Introduction**
MyCERT has received several incidents recently targeting Malaysian Internet users with bogus scam email that demand victim’s payment in bitcoin. As a preventive measure, MyCERT release this alert to advise Internet users in Malaysia to take necessary steps to secure their ICT devices against unwanted incidents as well from other security threats.
**2.0 Modus Operandi**
The scammer generally looked up personally identifiable information (PII) from previous data breaches available publicly online or sold in the dark web, including email addresses and passwords. The scammer then puts the information into an automated script that enables to send thousands of scam emails towards those compromised accounts.
Contents of the scam email claims that scammers implanted malware on victim’s computer that have placed some malicious code in the operating system belonging to the victims, which gathered all the contacts in social media accounts, Internet browsing history and keep tabs on online activities of the victims. As an example, the malware accessed their webcams and recorded footage of the victims watching porn videos from allegedly visited websites.
The scammer will be blackmailing victims by instructing victims to pay a certain amount in a short time limit to deliver the paymentof ransom in Bitcoins else the footage will be released to the collected contacts.
Figure 1: Sample of the bogus scam email
The email reads as follows:
```
I know, xxx, is your password. You don't know me and you're thinking why you received this e mail, right? 
Well, I actually placed a malware on the porn website and guess what, you visited this web site to have fun (you know what I mean). While you were watching the video, your web browser acted as a RDP (Remote Desktop) and a keylogger which provided me access to your display screen and webcam. Right after that, my software gathered all your contacts from your Messenger, Facebook account, and email account. 
What exactly did I do? 
I made a split-screen video. First part recorded the video you were viewing (you've got a fine taste haha), and next part recorded your webcam (Yep! It's you doing nasty things!). 
What should you do? 
Well, I believe, $1900 is a fair price for our little secret. You'll make the payment via Bitcoin to the below address (if you don't know this, search "how to buy bitcoin" in Google). 
BTC Address: 
bc1qzl2qlywq8fzfm49e7mvsuz4yvpdwpzfqs5g85r 
(It is cAsE sensitive, so copy and paste it) 
Important: 
You have 24 hours in order to make the payment. (I have an unique pixel within this email message, and right now I know that you have read this email). If I don't get the payment, I will send your video to all of your contacts including relatives, coworkers, and so forth. Nonetheless, if I do get paid, I will erase the video immidiately. If you want evidence, reply with "Yes!" and I will send your video recording to your 5 friends. This is a non-negotiable offer, so don't waste my time and yours by replying to this email.
```
**3.0 Recommendations**
Below are some recommendations for Internet users as preventive measures and mitigation steps against these attacks:     
- Do not panic.
- Do not respond or send any payments to the scammer.
- Immediately change your password on any online accounts that are using the compromised password as mentioned in the email.
- Delete the scam email and mark it as spam so that your email filter removes it.
- Use different password variations for each online account. This step should protect you in the future because if one account is breached, no other account should be affected.
- Never send compromising images of yourself to anyone, no matter who they are or who they say they are.
- Turn off [and/or cover] any web cameras when you are not using them.
- Scan the device with a reputable antivirus/anti-spyware to ensure that the device is clean.
- Report any such incidents or any enquiries 
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied. 
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**4.0    References**
1. <https://www.bleepingcomputer.com/news/security/large-email-extortion-campaign-underway-dont-panic/>
2. <https://blog.malwarebytes.com/cybercrime/2019/02/sextortion-bitcoin-scam-makes-unwelcome-return/>
3. <https://www.netsafe.org.nz/faketortian-email-scam/>
4. <https://nakedsecurity.sophos.com/2020/04/10/sextortion-emails-and-porn-scams-are-back-dont-let-them-scare-you/>