The IT Nerd

For the last few years I’ve been telling you about extortion phishing scam emails. If you’re not familiar with them, here’s how this scam works. You get an email from someone who claims to be some sort of elite hacker who has taken control of your PC and they’ve got some sort of incriminating video of you. And to keep the video from getting out to the public, you have to pay them. Pretty simple and straightforward. In this case, the scam takes a bit of a different twist. Let me start with the scam email that I got:

***The driver installation was successful***

The system has been added to the tracking list.

Your device has been successfully attacked by our bot-virus, which, once on the device, spreads to all layers of the device.
These are drivers, cameras, microphone, operating system services.

Your entire device is under our control. We can delete any data on it, write anything on it.

We copied all the data from your device to our server clusters recording dialogs, video from the web camera, from the main camera of the device, as well as everything that happened on the screen.
There is some very interesting nude video.
All your movements with the phone were recorded by GPS data during the entire time.

You have 48 hours to transfer 1100$ US dollars to our Bitcoin wallet [BITCOIN Wallet Address Redacted]

If no money is received after that time, all the data will be on the Internet.
Your social networking friends and phone contacts will especially like it.

As soon as the funds are credited to our account, your data will be deleted from our servers and the virus will be automatically deleted from your device and won’t bother you anymore.

Don’t forget that your device is completely under our control and don’t try anything foolish things.
If any action is suspected of finding a virus, contacting law enforcement, all your friends will be familiar with the fine selection of materials involving you.

***The timer was automatically run after you’ve opened this email.

So let’s unpack this email.

• In this case, the email was sent directly to my email address from what I presume is a “burner” email account. That’s interesting because usually, these scam emails are clearly sent to a mailing list of people. By clearly I mean that it the scam emails that I usually see are not addressed to your email address. I am guessing that this is meant to get your attention.
• This email also says that the so called hacker installed the “bot virus” on your computer. I am assuming that this is a deliberate attempt to circumvent spam filters which would be looking for words like “trojan virus” which is what I often see in scam emails. Or it could be that the threat actor isn’t that bright and is using terminology that they don’t understand.
• Any threat actor who can take complete control of your system (as in drivers, cameras, microphone, operating system services) via a virus wouldn’t be doing this sort of thing. They would instead be working for a nation state doing espionage or something similar.
• The threat actor claims to have gotten access to my phone and is monitoring my movements. Again, ignoring the fact that he started out saying he had control of your computer, someone this skilled would be working for a nation state doing espionage or something similar as opposed to trying to get $1100 from you.
• The threat actor wants you to pay him via Bitcoin. Fact: There’s no way for the scammer to know that you’ve paid him which means that there’s no way for him to delete the data that he allegedly has on you.
• The English used in this email is not that good. 
• It tries to play on your fears of being outed for having a nude video on your computer and goes as far as not to tell your friends or law enforcement.

The bottom line is that this guy has created a scam that isn’t all that good and is likely to convince few people to hand over their cash. And having a look at the Bitcoin wallet in the email, nobody has fallen for it yet. But since the number of people who could fall for this is not zero, I’m putting this out there so that the number gets as close to zero as possible.

It’s been a while since I got a scam email that was either new or different. But I finally have one that I would like to present to you. This one is using the Intuit brand and looks like this:

There’s some things that I would like to highlight about this scam email:

• The email address that it was sent to was in the body of the email. That shows that the threat actors are trying with this scam.
• The threat actors create a sense of urgency by saying things like “The debited amount will be reflected within 24hrs in your banking statement” and “If you didn’t authorize this charge, You have 24hrs.”
• The quality of the English in this scam email is better than normal, but it still highlights the fact that the threat actor that is creating this email does not natively speak English.

Another thing to note is that this email didn’t come from an Intuit email address:

Intuit as a company doesn’t use iCloud to send and receive email. So that should be the big hint that this is a scam and you should delete the email immediately and move on with your life. But seeing I am not most people, I wanted to see what this scam was all about. Though I assume that it’s the usual refund scam which goes like this:

• You get an email in your inbox saying that services that you know that you don’t have are being renewed, and the money has been debited from your bank account. 
• You then call the phone number provided to dispute this.
• The scammer talks you into getting remote access to your computer where they have you fill out some sort of form to get a refund for this purchase that you never made. Fun fact: The form that the scammers will have you fill out will ask for a lot of your personal information which can later be used to steal your identity. 
• The scammer will then have you check your bank account using your bank’s online services to see if you got your refund. But the scammer will use some sleight of hand to make it look like that they massively overpaid you. And then the scammer will blame you for that. 
• You will then be bullied into refunding the overpayment by buying cryptocurrency or gift cards to send to them electronically. Assuming that they just don’t steal your money straight from your bank account themselves, or have you go to your bank to transfer the money to them, or withdraw it in cash and have you send it to an accomplice via a courier. 

So I did what you should never, ever do, which is call the number in the email. However the number was disconnected when I did. It is possible that it was shut down by the threat actors by the time I called, or it got shut down. Either way, they’ll likely pop up with with another number to try and perpetrate this scam. But my best advice to avoid this sort of scam is if you don’t have a product or service from the company that you’re receiving the email from, delete the email and go on with your life.