‘Sextortion’ scam uses password breaches to target victims

File photo. (REUTERS/Kacper Pempel)

Scammers are upping their sexual extortion game.

Cyber-scammers are the ultimate opportunists. And the latest scam uses stolen passwords and sexual blackmail, according to a report from Barracuda Networks, an IT security company.

According to Barracuda, the sextortion scam works like this: First, they get your attention by sending an email flaunting a password stolen during a past data breach, such as the infamous data breaches from Yahoo! and Equifax.

KENTUCKY MAN SOLD PROGRAM THAT SPIED ON VICTIMS, MUST FORFEIT $725G

Then they claim that your computer has been infected with a Remote Access Trojan (RAT), which the scammers refer to as a “remote desktop.” The scammers claim remote access is coming from a pornography website and that they have recorded you watching “explicit videos.”

Then to really get your attention, the scammers claim to have your contact list and unless you pay up, the video will be distributed to all of your contacts.

One woman Barracuda spoke to has received a variant of the scam email three times during October. The passwords were "very old" but the scammers said that even if she had updated her passwords it didn't matter because "they’d been controlling the computer for years."

The criminals demand payment in Bitcoin. In one example, the scammers demand $5,000.

“The good news is there's no video or a list of contacts,” Barracuda said in a blog post.

"The attacker does have a legitimate password, but this was obtained most likely from the AntiPublic Combo List – a list of more than 500 million leaked passwords revealed through a number of breaches, which was made available back in 2016 – rather than from malware on the user's computer," Barracuda said.

The scam started in July and is still active, according to Barracuda, which found approximately 24,000 emails since September based on lists reported by customers. “The samples we examined were from customers manually reporting them, so it’s likely there are many times more that weren’t reported to us,” Barracuda said. Countries that are affected include Australia, Canada, China, as well as the U.S. A full list of countries can be found in the blog post.

So far, the scam has not been wildly successful, however.

One strike against the cybercriminals is a lack of English-language skills. “Better spelling and grammar would increase the effectiveness of the scam, given that English this poor has become associated with email scams in general,” Jonathan Tanner, a software engineer at Barracuda Networks, told Fox News.

NORTH KOREA AMPS UP CURRENCY SCAMS TO RAISE FUNDS, AVOID SANCTIONS, REPORT SAYS

Despite the ineffectiveness, these scams won’t go away. For one, the overhead for the scammer is extremely low. The criminals simply need to send emails to addresses on publicly available lists, Barracuda said.

“I think the scammers are just banking on a bit of quick money and given that it seems like there have been ransoms paid to their Bitcoin wallets – about $2,500 among 1000 wallets – the scam has been somewhat effective,” Tanner said.