Brits warned over mass ‘sextortion’ attack of 30,000 emails per hour – using 450,000 hijacked computers
BRITS are being warned of a new scam email in which hackers threaten to release nude photos of victims unless they pay a £600 ransom.
Scammers are sending up to 30,000 of the menacing messages an hour using a vast network of 450,000 hijacked computers, researchers warned.
The emails contain personal information, such as one of your passwords, in a bid to convince you they really do have your nudes.
According to the email, the images were captured through a hacked webcam. The ransom is payable in Bitcoin.
The kicker is, the scammers are lying: They don't have your photos, and are simply trying to scare victims into coughing up cash.
Researchers at Israeli security firm Check Point say that 27million people have been targeted by the scam campaign.
While few people have fallen for the ploy, one expert said such botnets still offered a great "return on investment" for cyber-criminals.
"A botnet can be used for many, many things," Charles Henderson, from IBM’s X-Force Red security team, which was not involved in the research, told BBC News.
"This was just one task assigned to it."
Sextortion scams, in which attackers ask for cash in return for not releasing compromising information, are on the rise.
Cyber crooks typically send out threatening emails to thousands or even millions of potential victims in the hopes of fooling a few of them.
The scams aim to trick users into handing over money by threatening to expose hacked webcam footage, stolen photos or browsing history.
Generally, the scammers have never actually acquired this material.
The new scam uncovered by Check Point used a botnet, a network of computers hijacked using malicious software spread by infected emails or websites.
Unbeknown to their owners, 450,000 hacked PCs were used as vessels to carry out the mass scam campaigns, explained research head Yaniv Balmas.
A typical email sent by the botnet had the subject line: "Save Yourself".
The message said: "My malware gave me full access to all your accounts (see password above), full control over your computer and it was possible to spy on you over your webcam."
The claim was not true but a victim's real password would appear in the email, likely obtained through existing data breaches.
"The attacker is saying, 'Hey, we hacked your computer, we saw you doing this and that, and this proves it. This is your password',” Mr Balmas said.
Check Point found that at least 11 Bitcoin, or around £77,000, had been extorted by the scammers.
Best ways to avoid extortion emails
Here's what you need to know...
- Ensure you have strong email protection technologies in place that will stop these emails from ever reaching your inbox
- Do not open emails or attachments, or click on links in emails, that are unsolicited or from unknown sources
- If you do receive one of these emails, do not panic
- Do not respond, do not click any links or open any attachments, and do not send money to the attackers
- Mark the email as spam and, if you feel it is necessary, alert authorities about the email
- Ensure all your online accounts are protected with strong, unique passwords, and enable two-factor authentication where possible
- If you think your account has been compromised or your password revealed in a password dump, you should change it immediately
"Most people don't fall for sextortion scams," Mr Balmas said.
"But it’s the rule of big numbers. If I'm sending 100,000 sextortion emails, it’s enough that 100 people fall for the trap. I get my money."
To avoid email extortion scams, experts advise you use the latest versions of software, particularly your web browser.
If you receive an extortion email, do not open the email or any attachments within, and do not respond. Do not send money to the attackers.
Mark the email as spam and, if you feel it is necessary, alert authorities about the email.
TOP STORIES IN TECH
In other news, sextortion scams that blackmail you using stolen webcam pics are on the rise, according to a recent report.
Another popular extortion hoax involves tricking a victim into thinking a bomb has been planted in their building.
You can read our full guide on sextortion, including how to stay safe online, here.
Have you ever been caught up in a nasty scam? Let us know in the comments!
We pay for your stories! Do you have a story for The Sun Online Tech & Science team? Email us at tech@the-sun.co.uk