Aussies warned about sex scams

Avast: 59,100 sextortion attempts took place in Australia in January

Credit: ID 67255616 © Liorpt | Dreamstime.com

Thousands of Australians faced sextortion attack attempts in January. Digital security and privacy products company, Avast has blocked more than half a million such attempts worldwide, most of which targeted English-speaking users. There were 59,100 attack attempts in Australia.

The company said all of the sextortion campaigns it had seen used the same modus operandi, with scammers sending emails to users claiming they recorded the user during private, intimate moments, and threatening to expose them to the public unless the victim pays money to the attacker.

Avast threat labs researchers advise people to stay calm and ignore sextortion emails instead of reacting to them, as they usually are fake claims

“Sextortion scams are dangerous and unsettling, and can even have tragic consequences resulting in the suicide of affected users. During the COVID-19 pandemic, cybercriminals likely see a strong opportunity for success as people spend more time on Zoom and in front of their computer overall,” Avast malware analyst, Marek Beno said. “As scary as such emails may sound, we urge people to stay calm if they receive such a message in their inbox and ignore it, as it is just a dirty trick that cybercriminals use to try to get your money.”

The most prevalent sextortion campaign takes advantage of the increased use of video conferencing services during the Covid-19 pandemic, falsely claiming to have accessed a user’s device and camera. Avast saw an uptick of these campaigns during December 2020. The threat actors claim in an email they took advantage of critical vulnerabilities in the Zoom application, allowing them access to the user’s device and camera. The company has not found any actual vulnerabilities in the Zoom application.

The email also mentions a “recorded sexual act”, that the attacker got “access to sensitive information”, and that this can lead to “terrible reputation damage” unless a payment of $2000 in Bitcoin is made.

A distinctive feature of this campaign is that emails look like they are sent from the user’s email address to themselves, however, only the sender’s name displayed has been modified and clicking on it reveals the real email address of the sender.

The second most common campaign sends an email in which the attackers claim a Trojan was installed on the recipient’s machine a few months ago, which then recorded all of the potential victim’s actions with a microphone and webcam, and exfiltrated all data from the devices, including chats, social media, and contacts.

The attackers demand a ransom in cryptocurrencies and include a note about a fake “timer” that started when the email was received, in order to set a ransom deadline.

“As with the Zoom campaign, these threats are all fake. There are no undetectable Trojans, nothing is recorded, and attackers do not have your data. The timer included in the email is another social engineering technique used to manipulate victims into paying,” Marek Beno said.

Avast threat researchers have observed additional sextortion campaigns some of which are originally in different languages and the content is automatically translated in a tool like Google Translate.

How to recognise sextortion emails

  • Sextortion scams are emails that falsely claim that the sender of the email owns a recording of their screen and camera, showing the user in intimate moments. 
  • The attackers often emphasise the humiliation and embarrassment of the situation to blackmail the victim into paying them money, often in cryptocurrencies like Bitcoins. 
  • Often, the language used is perfect, however sometimes attackers simply seem to be using Google Translate to localise a message, which can be another indicator for users that the message is not trustworthy.
  • In some cases, the email looks like it is sent by the victim itself, but the true sender can easily be revealed by clicking on the sender name, which will show the email address the message was sent from.
  • Attackers may show you old, leaked passwords of yours to make their message more credible. However, leaked passwords are sold on the dark web and attackers can easily use them for their campaigns to cause additional concern. You can check if your password has been stolen by using Avast Hack Check.

How to protect yourself from sextortion emails

  • Stay calm: In reality, the attacker does not actually own any recordings and is using social engineering techniques to scare and shame you into paying. 
  • Treat the email like you would treat spam emails: Ignore them. Do not respond and don’t pay any money.
  • Change your passwords: If the attacker has included an older leaked password of yours, change your password to a long, complex password if you haven’t done so already.

 

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags scams

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

By Mike Gee

PC World
Show Comments

Essentials

Mobile

Exec

Budget

Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?