17

I received an email saying that someone has hacked my email over 6 months ago and they say that through it they have infected my operating system with a virus. They say they have access to all my accounts, browsing history, photos, files on my computer, they also said that they have taken screenshots through the camera on my device.

Is this at all possible? I do have a computer that I use occasionally but mainly go through my iPad or iPhone.

Improve this question
9
  • 2
    Clearly they hacked your password from somewhere, most likely a forum. This illustrates why you must use strong, unique passwords for everything. That said, it's a scam. All they did was get emails and passwords, the password is probably not for the email account (unless you are particularly bad as assigning passwords). They didn't touch your computer, they don't have links of the porn sites you go to. You can't even email them back, thats how fake it is.
    – l008com
    Oct 22, 2018 at 12:39
  • 20
    It is worth noting that receiving an e-mail does not mean your e-mail has been hacked or compromised. Your e-mail address is likely public or guessable. These e-mails are sent blindly to thousands of possible e-mail addresses. Do not worry. We get e-mails like this every few days to our public company address; we ignore them all.
    – Graham Miln
    Oct 22, 2018 at 14:42
  • 1
    Related
    – Tom K.
    Oct 22, 2018 at 16:27
  • 2
    Are they asking you to take any actions to "secure" your account? (If they are, don't take any of them). Are there links in the email? (if there are, don't click any of them). The actions they're trying to get you to take can speak volumes towards what they're doing.
    – Lord Farquaad
    Oct 22, 2018 at 19:22
  • 1
    The only time such an email should be given any weight at all is when it comes from your own email address with only one Received header.
    – Joshua
    Oct 23, 2018 at 15:18

4 Answers 4

Reset to default
39

Fake. Delete It and Move On

I got a similar email last week and it is fake. All the details you mentioned are identical to the email I received. In my case, I use 2-factor authentication for my Gmail account, LastPass for my password management and a VPN for all my connected devices. The most telling part of the fakery is that the ‘hacker’ compromised you six months ago, yet has not taken any action. If they have the goods on you, why not sooner? Lastly, the email appeared in my Gmail SPAM filter. That’s the biggest clue to that it is SPAM.

Sample Spam

Hello!

My nickname in darknet is hort17. I hacked this mailbox more than six months ago, through it I infected your operating system with a virus (trojan) created by me and have been monitoring you for a long time.

So, your password from is (and incorrect, btw).

Even if you changed the password after that - it does not matter, my virus intercepted all the caching data on your computer and automatically saved access for me.

I have access to all your accounts, social networks, email, browsing history. Accordingly, I have the data of all your contacts, files from your computer, photos and videos.

I was most struck by the intimate content sites that you occasionally visit. You have a very wild imagination, I tell you!

During your pastime and entertainment there, I took screenshot through the camera of your device, synchronizing with what you are watching. Oh my god! You are so funny and excited!

I think that you do not want all your contacts to get these files, right? If you are of the same opinion, then I think that $890 is quite a fair price to destroy the dirt I created.

Send the above amount on my BTC wallet (bitcoin): 1EZS92[...redacted...]E62e9XY As soon as the above amount is received, I guarantee that the data will be deleted, I do not need it.

Otherwise, these files and history of visiting sites will get all your contacts from your device. Also, I'll send to everyone your contact access to your email and access logs, I have carefully saved it!

Since reading this letter you have 48 hours! After your reading this message, I'll receive an automatic notification that you have seen the letter.

I hope I taught you a good lesson. Do not be so nonchalant, please visit only to proven resources, and don't enter your passwords anywhere! Good luck!

Improve this answer
11
  • 19
    Hahahahaha. Tbh this is a better phishing attempt then most. But some dead give aways are the use of buzz words. "darknet" "synchronizing" "passwords" "data" "cache". Also the sense of urgency, "48 hours". Lastly, if you take out the emotion there is 0 information. No proof that he has anything: passwords, emails, pictures, porn (which is apparently "very wild"😜 ). But nice try...
    – user7886229
    Oct 22, 2018 at 11:05
  • 2
    Thanks for the edits, Graham. I posted while in motion (Uber was driving) and had to save sooner than expected.
    – IconDaemon
    Oct 22, 2018 at 11:41
  • 11
    The password that it claims is the one for your e-mail is probably one you have used long ago on a website that got compromised (at least it is for me). See if it is in the Have I Been Pwned? password database.
    – fkraiem
    Oct 22, 2018 at 12:02
  • 3
    I got this same email, for what it's worth along with a password I've used in the past, but not for that specific email account. Always use unique passwords!
    – rrauenza
    Oct 22, 2018 at 16:03
  • 1
    @fkraiem Hmmmmm I wonder how they got your password. My spidey senses say someone hasn't been hashing....
    – user7886229
    Oct 22, 2018 at 18:31
12

Yes, it is a scam. There are two clever things that it does to make itself appear real (at least, more real than most scams), but those can be relatively easily debunked.

  • Firstly, it uses your own e-mail address as the "From" address. However, just like you can write any address on the back of an envelope before slipping it in the box and no one is going to check whether it is really your address, you can in principle write any address in the "From" header of an e-mail. (Some e-mail services may not allow you to do this, but it is a limitation of those particular services, and not of the e-mail medium itself.) Therefore, just because your e-mail address appears is no proof that your account was compromised.

  • Secondly, it shows you a string that it claims is the password for your e-mail, and this claim actually has a non-negligible chance of being correct. Remember those "Big Website compromised; user data leaked!" headlines you see in the news from time to time? Well, you probably had an account on one of those websites using your e-mail address and that password; the scammer obtained that information from the leaked data and is betting that you use the same password for your e-mail account. Have I Been Pwned? is a useful service that aggregates all the leaked data from known breaches so you can check whether your e-mail or password appears in any of them.

Finally, you can search for the given bitcoin address on a bitcoin lookup service such as this one; it has almost certainly been reported as a scam already (and you can see from the address's activity that these scams do work).

Improve this answer
1
  • 1
    Specifically, the process of changing the 'from' address to another address it's not actually from is called 'spoofing', and such emails will fail header 'alignment checks' on that address if you examine the email source header.
    – SE Does Not Like Dissent
    Oct 23, 2018 at 17:33
3

There are only 2 things you need to do.

1. Change your password. *

Most of the email addresses that are receiving these, are from leaked databases that may have contained your actual password. They are mass mailing and mail merging people from this database, looking for money, or even a response. Chances are high that they indeed DO have the correct password, it's why they include it in the email. if the password supplied in the email is your actual password for any site or service, change your password on those sites, but not via any links in this scam email

2. Do NOT respond. Delete the email.

Any response at all, singles you out from the literal millions of people in the same situation, is going to single you out from background noise. Whether you are saying "Get lost, that's not my password" or "Please don't hack me, here is $$$" or "Come at me, I have nothing important" You have still engaged them, told them it's a live email address, and that you are prone to reading and responding. This increases value in your email address and you will either be sold on as a 'lead' to someone else, or actively exploited by the spammer.

Never Ever consider paying them

If you pay them, they realize they had leverage, why would they stop when they just got a positive hit and payment? They will use this to pivot, blackmailing you further, actually hacking your accounts, grabbing nudes and distributing them on facebook etc, unless you pay them a monthly fee, or help them launder money, send parcels in the mail etc.

Improve this answer
6
  • 1
    Item 1 is bogus. There is no indication that they have OP's password and no reason to change passwords over random spam. The rest of this answer is good but I can't upvote for part 1.
    – R.. GitHub STOP HELPING ICE
    Oct 23, 2018 at 14:39
  • 2
    The indication they have OP's password is that this spam OFTEN has OP's password specified in the email (as of the time of the leak. I've received these emails in my own inbox and had to change because of it) I'll edit to make it more clear.
    – Ryan Leach
    Oct 23, 2018 at 14:43
  • The passwords in these scams are from leaks of other accounts, not the mark's email account. Unless OP actually reused their email password on other sites, there is no reason to believe the scammer has their password.
    – R.. GitHub STOP HELPING ICE
    Oct 23, 2018 at 14:46
  • 3
    > Unless OP actually reused their email password on other sites. Surprise! Most non IT experts do. > "of other accounts," False. Current wave of spam are indeed using the correct unhashed password of accounts associated with this email on various sites. The only way you can avoid it is by not reusing passwords, or changing them since the leak.
    – Ryan Leach
    Oct 23, 2018 at 14:47
  • And there's a very good psychological reason not to take any measure in reaction to such email: it conditions the person taking the action to think of random scams as having some element of truth to them. The only right response to spam is to ignore/delete it.
    – R.. GitHub STOP HELPING ICE
    Oct 23, 2018 at 14:48
1

Many years ago, during college, I received a similar email, but the fun part was, it was from my own email address

It turned out to be a prank from friends

If you used an edu mail server, gmail used to trust any sender address as valid, even if it's your own email address

So to extend the asked question a bit, even if you receive such an email from your own email address (you should check the original email data and) ignore it

Improve this answer
3
  • 1
    The from address can be spoofed by anyone. It is just text no checks are made on it or can be as it flows through servers
    – mmmmmm
    Oct 23, 2018 at 17:37
  • @Mark checks are made on it alright, it should almost always be spam if these checks fail
    – Kaan
    Oct 24, 2018 at 18:03
  • I received the same email mentioned in the answer of IconDeamon. It is seen that the email is from my own mail account. But when I checked the sent folder of my mail account there is no such email sent.
    – guest
    Oct 27, 2018 at 18:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .