Estimated read time: 2-3 minutes
This archived news story is available only for your personal, non-commercial use. Information in the story may be outdated or superseded by additional information. Reading or replaying the story in its archived form does not constitute a republication of the story.
SALT LAKE CITY — Investigators have been warning Utahns not to fall for a sophisticated email ruse that displays the recipient’s correct usernames and passwords before demanding money in exchange for not releasing embarrassing videos.
"A login and a password that you commonly use for everything—that might get your attention right away," said Sgt. Jeff Plank with the Utah Department of Public Safety’s cybercrime unit.
So far, Utah’s Statewide Information and Analysis Center, or SIAC, has received about 30 complaints about the new spear-phishing emails that appear to originate from addresses with an outlook.com domain.
“They’re trying to scare people into thinking that they could be embarrassed greatly,” said Sgt. Plank, who is also a member of the FBI Cyber Task Force.
The emails, which include correct login information in the subject line, quickly get to the point of threatening to distribute compromising videos and Internet browsing activity if a bitcoin payment isn’t received within a few days.
"I won’t beat around the bush," begins one of the emails. "I am aware (redacted) is your password. Most importantly, I know your secret and I have proof of it."
The emails go on to say that the scammers got control of the recipient’s computer, and then tracked them as they visited adult websites while simultaneously recording them through their computer’s webcam.
Without the required bitcoin payment—that ranges from $1,000 to $7,000—the author of the email promises to release the video to "family, coworkers and many others" and reminds of "the humiliation you and your family will face when relatives and buddies find out your unpleasant video from me in their inbox."
Investigators with SIAC said it’s "highly unlikely" that the sender of the emails actually installed malware on the victims’ computers and recorded any video. As for the correct email passwords, it’s likely they were obtained from the many high-profile data breaches that have happened in recent years.
"Not many people realize that their logins and passwords have been compromised," Sgt. Plank said, adding that it’s a good reminder to change passwords frequently.
Those who have received similar emails are asked to submit a cybercrime tip at siac.utah.gov.
