Email phishing: you could be one click away

Tommy
4 min readSep 4, 2020

--

You don’t know me and you’re thinking why you received this email, right? I believe one of your passwords is *****.

Well, I actually placed a malware on the porn website and guess what, you visited this web site to have fun (you know what I mean). While you were watching the video, your web browser acted as a RDP (Remote Desktop) and a keylogger which provided me access to your display screen and webcam. Right after that, my software gathered all your contacts from your Messenger, Facebook account, and email account.

What exactly did I do?

I made a split-screen video. First part recorded the video you were viewing (you’ve got a fine taste haha), and next part recorded your webcam (Yep! It’s you doing nasty things!).

What should you do?

Well, I believe, $1400 is a fair price for our little secret. You’ll make the payment via Bitcoin to the below address (if you don’t know this, search “how to buy bitcoin” in Google).

BTC Address: 1Dvd7Wb72JBTbAcfTrxSJCZZuf4tsT8V72

(It is cAsE sensitive, so copy and paste it)

Important:

You have 24 hours in order to make the payment. (I have an unique pixel within this email message, and right now I know that you have read this email). If I don’t get the payment, I will send your video to all of your contacts including relatives, coworkers, and so forth. Nonetheless, if I do get paid, I will erase the video immediately. If you want evidence, reply with “Yes!” and I will send your video recording to your 5 friends. This is a non-negotiable offer, so don’t waste my time and yours by replying to this email.

I woke up to this phishing email in the course of the week and being no stranger to such, I never bothered to lift a finger. However, as an afterthought, I considered those who could get perturbed on the event of such reception. I imagined how fearful and unsettled it could leave some others, so I decided to write about it.

First and foremost, let me state that I doubt anyone with a genuine threat would hesitate to send at least an exhibit to drive their point, so there is no need to panic if you receive such a message. Albeit, the password the scammer claimed to have happens to be one of my old passwords, which I had long stopped to use, it still does not justify going ahead to yield to the threatening proposal.

Email phishing is one of the oldest tricks in the book. It is a disguised attempt to lure potential victims into submitting their personal or financial information, and in some cases, unknowingly installing malware on their devices. Malware is any malicious software specifically designed to cause damages to your devices or to give the intruder unauthorized access to your device or network of devices.

Email phishing comes in the form of a deceptive email or website, with the main intent of misleading you to earn their trust so you could divulge those details they want from you. In the email I got, for instance, the plot was to get me scared of having my nude pictures being flooded over the internet and were it successful, I would have trusted the attacker to send the requested $1400, which he/she called a fair price. Some other emails might even include links to “unsubscribe”, with the intent of leading you to click on the disguised link.

Is clicking the end of life?

What should be your response if you find yourself in a situation where you accidentally click on a phishing link? Well, knowing early that you are on the wrong track could keep you away from a lot of troubles. Firstly, do not divulge any personal information or give access to allow any requested service. Then try to instantly disconnect from the internet at that moment. After you return, change all of your passwords.

How do you stop yourself from being a victim?

When you receive a phishing message, just proceed to delete. Do not be scared or compelled to pay anyone. Also, try not to be enticed to any attractive offer.

Avoid opening attachments from those you do not know or trust no matter how enticing or compelling it might appear.

When your webcam is not in use and you are browsing the internet, make sure it is turned off or better still, have it covered.

Do not use a single password for all of your accounts. It would make you quite vulnerable in an event of a successful intrusion. Also, make sure the passwords are hard to predict and are often changed to avoid being at risk. The best form of password to use is the multi-factor authentication, where asides the characters you input, you would also have to confirm on a physical device within your reach.

When using a public device or one that is not yours to access the internet, use the incognito mode. With that, your browsing history is not stored. Cookies, which collect information about the pages visited, would also not be stored; as they are erased after every session. So the moment you close the incognito window, there will be no record of the visited sites in the device’s history and the sites you visited would not be able to record information about you. Browsing in a regular window, instead, stores the URL of every page you visit and keeps the information even after you have closed the windows.

In conclusion, be careful of what content you trust online because, with a click, you could be the next victim.

Thank you

--

--