TR Forums

Anyone else been getting these? Scammer claims to have hacked your computer, and as "proof" offers an old password (which was likely obtained from any one of a number of past security breaches of sites with weak password encryption). Claims to have installed a RAT on your PC, and obtained compromising info and your contact list; they will "out" you if you don't pay several hundred $ in Bitcoin.

I guess they're counting on people who rarely change their password, use the same password across multiple sites/accounts, and have incriminating info on their PC and/or in their browsing history to get tricked into believing something's really going on, and pay up.



If you spew that crap out to millions of people, maybe a few here and there will actually believe it and pay up...?

I've received maybe a half dozen or so of these in the past couple of weeks. They've been making it through Google's spam filter, though I suppose that will end as the filter gets "trained" to recognize them as spam/scam e-mails.

Is the password correct?

They may send it to millions, a few might bite, but I do wonder how many of these would be actual crypto users.

It's a password I used on a few non-critical (otherwise I wouldn't have re-used it) sites several years ago. I'm sure they're counting on some people re-using the same password everywhere to convince their victims that their PC has actually been hacked.

At least one of the scam e-mails even copy-pasted the old password wrong (cut off the first letter).

just brew it! wrote:

It's a password I used on a few non-critical (otherwise I wouldn't have re-used it) sites several years ago. I'm sure they're counting on some people re-using the same password everywhere to convince their victims that their PC has actually been hacked.

At least one of the scam e-mails even copy-pasted the old password wrong (cut off the first letter).

I've been getting these emails too even through Google, there may be some randomness to the titles that allows them to go through anti-spam filters.

Some background info for other people: This is from numerous sites that get hacked and the credential information gets compiled into massive user/password lists. Nothing to worry about really (unless you actively use that password... shame on you people if you do this), just some scammers scraping these lists and sending phishing emails to people. You can check what sites have been compromised for sure if you look up your email in https://haveibeenpwned.com/

I get them all the time, even at my .gov work email address. It's usually fairly entertaining to screw with them though.

I haven't run into this one yet. But the vast majority of my poorly secured accounts also use a crappy free email address that I never check, so I likely won't notice if they do try to come after me.

This is the next wave of ransomware. The scammers are trying to play into "whales" who got "rich" on the last crypto-currency craze.

An ex-coworker's address has been getting a multitude of "I hacked your webcam and recorded you having fun at an adult website" extortion attempts lately. Most of them say "I know your password is ____", but it's always just randomized nonsense that incorporates the username. I've seen prices range from $400 - $6,000 so far

just brew it! wrote:

It's a password I used on a few non-critical (otherwise I wouldn't have re-used it) sites several years ago.

Seem with me.......an old password from years ago. I dont even respond.

A couple of my users started getting these a few months ago.

I haven't gotten one yet, but I did get an email from the IT dept letting everyone know that there was a large number of these messages coming in and to be aware if one made it through all the spam traps.

--SS

I got one of those a few days ago too.
In my case it was the password of a website I haven't used in years (RentACoder / Freelancer / whatever).
The password was correct and not used in any other websites, so the only explanation is they got hacked.
I did some quick googling for breaches on that website, and nothing. I wouldn't be surprised they never bothered telling their users they got hacked.

Anyway, I change the password, ignored the email, and moved on.

Some of the passwords dumps they use are know, I have a thing where I used a couple of chars so I could identify which site something came from...
One of the dumps is the adobe dump, another is Fred Miranda, but if you go look at Troy Hunt's site Haveibeenowned you can assume all the big freely available dumps are used.

The latest batch have even started omitting the passwords entirely just basically doing a lazy ass copycat scam of a scam version if the whole thing...

Yeah, I'm pretty sure mine came from the Adobe dump. That was one of the sites I used that password on.

i feel left out.

Got one this morning to the same work address demanding 9,000

I've been getting text messages wanting me to claim x amount of bitcoin in exchange for certain details. Had one yesterday show up while I was at work.

biffzinker wrote:

I've been getting text messages wanting me to claim x amount of bitcoin in exchange for certain details. Had one yesterday show up while I was at work.

I've long wondered (day job) when the age-old 419 scam would move to dangling Bitcoins in front of people. I need wonder no longer. Betcha the weblink/email comes complete with some ransomware as well, just to keep the Bitcoin books balanced.

I got one of these today. I'm almost certain it was tied to the Adobe breach. The password included in the email is so old that if I'm still using it on a website, that account deserves to be hacked. LOL

A couple of my users have gotten these, snuck through Office 365. Both of them had legit old passwords. One of my users in particular was legit freaked out by it, but I was so decisively dismissive that I think they felt better quickly. I just told them to make sure they aren't using that password anywhere anymore.

I just got a few of them in the past few days - none had a password I recognized. Weird.

Yeah, the first few I got had a password which I'm pretty sure leaked in the Adobe breach. Since then the passwords have been random (and not something I've ever used). They're still coming, but Google is doing a better job of sending them to the Spam folder without manual intervention.

Mass Email Hoax Causes Closures Across US And Canada - Ars

Looks like the spammers have taken things to the next level. Wow. Certainly hope it's not a sign of things to come, but unfortunately I suspect it will be. I disagree with the article somewhat, as he alludes towards it being something state-sponsored. While entirely possible, I'm generally more pragmatic when someone suggests conspiracy. To me, it seems like a natural (though insane) escalation of what they were already trying to pull. Criminals aren't known for their clear, logical thinking.

For me it was the Weather Underground password (I mostly use unique ones on every site just for this reason) but boy, when that Email came in, was I ever livid.
My kiddo shared my E-mail for a while for Cub Scouts until he was old enough to have his own. I had some 'splainin to do about web security, privacy, what most people use the internet for... it was an "interesting" discussion. Of course he is getting to "that age" when he will be testing the limits of my bandwidth soon. Ugh.

You have to admire the cleverness of this "hack" and I am sure it was very successful. Sometimes I wish the mob were still powerful, and a hacker would mess with the wrong dude.

Yup, my company got hit with the latest bomb threat extortion.
Glad our users were smart enough to just report it to I.T. and carry on.

Nothing of the sort here, I only have a hotmail and my university email account though.

Arvald wrote:

Yup, my company got hit with the latest bomb threat extortion.
Glad our users were smart enough to just report it to I.T. and carry on.

Ya our company has integrated a "phishing scam" button into outlook. Some days I feel like clicking it for meeting requests

anotherengineer wrote:

Arvald wrote:

Yup, my company got hit with the latest bomb threat extortion.
Glad our users were smart enough to just report it to I.T. and carry on.

Ya our company has integrated a "phishing scam" button into outlook. Some days I feel like clicking it for meeting requests

Just make sure that it the meeting is scheduled somewhere warm and I'll accept.

anotherengineer wrote:

Arvald wrote:

Yup, my company got hit with the latest bomb threat extortion.
Glad our users were smart enough to just report it to I.T. and carry on.

Ya our company has integrated a "phishing scam" button into outlook. Some days I feel like clicking it for meeting requests

oh if anyone is wondering the current wording of the scam

Objet : Use your time wisely

Good day. There is a bomb (Tetryl) in the building where your business is located. My recruited person built the explosive device according to my guide. It can be hidden anywhere because of its small size, it is impossible to damage the supporting building structure by this bomb, but if it detonates you will get many wounded people.
My mercenary keeps the building under the control. If he notices any unusual activity, panic or emergency he will blow up the bomb.
I want to suggest you a deal. 20'000 usd is the price for your life and business. Pay it to me in BTC and I assure that I have to withdraw my man and the bomb will not explode. But do not try to deceive me- my guarantee will become actual only after 3 confirms in blockchain network.

My payment details (BTC address)- 15qH84uLC49CmC6jRE958Qjcf9WRZ2rMuM

You have to solve problems with the transaction by the end of the working day. If the working day is over and people start leaving the building the device will detonate.
This is just a business, if I do not see the bitcoins and a bomb detonates, next time other companies will send me more bitcoins, because it isnt a one-time action.
To stay anonimous I wont visit this email. I monitor my wallet every 20 min and if I see the payment I will order my man to get away.

If an explosion occurred and the authorities see this email-
We are not terrorists and do not take liability for acts of terrorism in other buildings.

I love the little blurb at the end, as if that's going to prevent the FBI or whoever from knocking their door in.