# MA-809.062021: MyCERT Alert - Bogus Scam Email is on the Rise

**Date:** 25 Jun 2021  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-809.062021  
**Advisory ID:** MA-809.062021

---

**1.0 Introduction**
MyCERT has received several incidents recently targeting Malaysian Internet users with bogus scam email that demand victim’s payment in bitcoin. This incident has been reported since 2018. As for this year, the scam uses a language localization email template of "Bahasa Melayu". As a preventive measure, MyCERT release this alert to advise Internet users in Malaysia to take necessary steps to secure their ICT devices against unwanted incidents as well from other security threats.
**2.0 Modus Operandi**
The scammer generally looked up personally identifiable information (PII) from previous data breaches available publicly online or sold in the dark web, including email addresses and passwords. The scammer then puts the information into an automated script that enables to send thousands of scam emails towards those compromised accounts.
Contents of the scam email claims that scammers implanted malware on victim’s computer that have placed some malicious code in the operating system belonging to the victims, which gathered all the contacts in social media accounts, Internet browsing history and keep tabs on online activities of the victims. As an example, the malware accessed their webcams and recorded footage of the victims watching porn videos from allegedly visited websites.
The scammer will be blackmailing victims by instructing victims to pay a certain amount in a short time limit to deliver the paymentof ransom in Bitcoins else the footage will be released to the collected contacts.
*Figure 1: Sample of the bogus scam email*4.0 Recommendations**
Below are some recommendations for Internet users as preventive measures and mitigation steps against these attacks:     
- Do not panic.
- Do not respond or send any payments to the scammer.
- Immediately change your password on any online accounts that are using the compromised password as mentioned in the email.
- Delete the scam email and mark it as spam so that your email filter removes it.
- Use different password variations for each online account. This step should protect you in the future because if one account is breached, no other account should be affected.
- Never send compromising images of yourself to anyone, no matter who they are or who they say they are.
- Turn off [and/or cover] any web cameras when you are not using them.
- Scan the device with a reputable antivirus/anti-spyware to ensure that the device is clean.
- Always use multi-factor authentication (MFA) to add an extra step of email security.
- Report any such incidents or any enquiries 
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. <https://blog.malwarebytes.com/social-engineering/2021/01/new-sextortion-scam-in-time-for-the-new-year/>
2. <https://www.mycert.org.my/portal/advisory?id=MA-464.032015>
3. <https://www.mycert.org.my/portal/advisory?id=MA-785.042020>