Loading story…
A new wave of sextortion emails is using the familiar “Hello pervert”/“I recorded you” template, falsely claiming the recipient was infected via a drive-by exploit and recorded through their webcam. To increase credibility, the messages include a real password associated with the target and demand payment (e.g., $800 in Bitcoin) to prevent alleged video/data release; the password reuse strongly suggests sourcing from previous data breaches and credential dumps rather than any actual device compromise.
Guidance for recipients emphasizes treating these messages as scams: do not pay, stop engagement, preserve evidence, and report to appropriate authorities (e.g., FBI IC3 in the US). Separately, phishing activity impersonating United Healthcare has been observed using a “free Oral-B toothbrush” lure and IPv6-mapped IPv4 literals (e.g., http://[::ffff:5111:8e14]/ → 81.17.142.20) to obfuscate scam infrastructure and route victims to rotating landing pages aimed at stealing PII and payment card data—a distinct fraud technique from the sextortion emails but similarly focused on social engineering and monetization.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Security analysis reported that at least one sender appeared to be using real passwords harvested from publicly accessible disposable inboxes on FakeMailGenerator. The exposed passwords were included in the sextortion emails to make the threats appear more credible.
By March 2026, a new wave of sextortion emails using the subject line 'You pervert, I recorded you!' was circulating. The messages reused the long-running 'Hello pervert' scam format, falsely claiming webcam compromise and demanding $800 in Bitcoin within four days.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A wave of threatening email campaigns is using intimidation and recycled data to pressure recipients into paying attackers. One campaign sent sextortion emails demanding **$2,000 in Bitcoin**, falsely claiming the sender had hacked victims’ devices, activated cameras and microphones, and recorded visits to adult websites. Reporting indicates the messages relied on email addresses exposed in earlier **ShinyHunters-linked** data leaks, with criminals referencing companies associated with the recipient’s address to make the threats appear credible. Betterment said some customers received the emails and emphasized that possession of an email address alone does not give an attacker access to a device. A separate warning from **CERT Bulgaria** described a campaign of threatening emails about allegedly planted explosive devices, underscoring a broader pattern of coercive messaging designed to trigger fear rather than reflecting confirmed compromise. Together, the incidents show how threat actors are repurposing previously leaked personal data and high-pressure hoax narratives to drive extortion and social engineering, while security authorities and affected organizations stress that recipients should treat the claims as fraudulent unless independent evidence shows an actual intrusion.
Aug 10, 2026
A sextortion email campaign is using real email addresses exposed in prior **ShinyHunters-linked** data breaches to make fraudulent threats appear credible and demand **$2,000 in Bitcoin**. The messages claim the sender compromised victims’ devices, installed malware, accessed cameras and microphones, and recorded visits to adult websites, then threaten to release supposed footage unless payment is made within 48 hours. Reporting found **no evidence** that the scammers had actual access to recipients’ devices or accounts. The campaign appears to be run by actors **impersonating ShinyHunters**, not by the extortion group itself, and relies on previously leaked data from breaches affecting organizations including **Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread,** and **McGraw Hill**. Some targeted addresses were confirmed to match leaked datasets, reinforcing the scam’s plausibility, while affected organizations such as Betterment warned customers that the messages are a common extortion attempt and advised recipients not to pay or respond.
Jul 28, 2026
The FBI warned that cybercriminals are compromising adults’ and children’s online and social media accounts to steal intimate photos and videos, then using the material for **sextortion, harassment, stalking, and public exposure**. The activity involves sexual exploitation actors who obtain explicit content and threaten to leak or advertise it online, including by posting stolen material on victims’ own social media profiles. According to the alert, attackers are gaining access through **social engineering**, **phishing pages on lookalike domains**, **brute-force attempts**, and credential attacks using leaked or reused passwords, while some also impersonate platform customer support staff such as Instagram representatives. The warning highlights an ongoing account-takeover campaign targeting social media users, with particular concern for younger victims whose stolen content may be distributed publicly to intensify extortion pressure.
Aug 13, 2026