Loading story…
A sextortion email campaign is using real email addresses exposed in prior ShinyHunters-linked data breaches to make fraudulent threats appear credible and demand $2,000 in Bitcoin. The messages claim the sender compromised victims’ devices, installed malware, accessed cameras and microphones, and recorded visits to adult websites, then threaten to release supposed footage unless payment is made within 48 hours. Reporting found no evidence that the scammers had actual access to recipients’ devices or accounts.
The campaign appears to be run by actors impersonating ShinyHunters, not by the extortion group itself, and relies on previously leaked data from breaches affecting organizations including Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill. Some targeted addresses were confirmed to match leaked datasets, reinforcing the scam’s plausibility, while affected organizations such as Betterment warned customers that the messages are a common extortion attempt and advised recipients not to pay or respond.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Organizations affected by the earlier data leaks, including Betterment, issued warnings about the emails and described them as a common extortion scam. The warnings followed use of leaked addresses from breaches affecting firms such as Amtrak, Hallmark, Substack, and Betterment.
ShinyHunters denied involvement in the sextortion campaign and suggested unrelated actors were reusing previously leaked breach data. Reporting found no evidence that the senders had actually installed malware or accessed victims' cameras or microphones.
A sextortion campaign began in April using email addresses exposed in prior ShinyHunters-linked breaches to make fraudulent threats appear credible and demand $2,000 in Bitcoin. The emails falsely claimed recipients' devices were compromised and that compromising recordings would be released unless payment was made.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A wave of threatening email campaigns is using intimidation and recycled data to pressure recipients into paying attackers. One campaign sent sextortion emails demanding **$2,000 in Bitcoin**, falsely claiming the sender had hacked victims’ devices, activated cameras and microphones, and recorded visits to adult websites. Reporting indicates the messages relied on email addresses exposed in earlier **ShinyHunters-linked** data leaks, with criminals referencing companies associated with the recipient’s address to make the threats appear credible. Betterment said some customers received the emails and emphasized that possession of an email address alone does not give an attacker access to a device. A separate warning from **CERT Bulgaria** described a campaign of threatening emails about allegedly planted explosive devices, underscoring a broader pattern of coercive messaging designed to trigger fear rather than reflecting confirmed compromise. Together, the incidents show how threat actors are repurposing previously leaked personal data and high-pressure hoax narratives to drive extortion and social engineering, while security authorities and affected organizations stress that recipients should treat the claims as fraudulent unless independent evidence shows an actual intrusion.
Aug 10, 2026
A new wave of **sextortion emails** is using the familiar “Hello pervert”/“I recorded you” template, falsely claiming the recipient was infected via a *drive-by exploit* and recorded through their webcam. To increase credibility, the messages include a real password associated with the target and demand payment (e.g., **$800 in Bitcoin**) to prevent alleged video/data release; the password reuse strongly suggests sourcing from **previous data breaches** and credential dumps rather than any actual device compromise. Guidance for recipients emphasizes treating these messages as scams: **do not pay**, stop engagement, preserve evidence, and report to appropriate authorities (e.g., **FBI IC3** in the US). Separately, phishing activity impersonating **United Healthcare** has been observed using a “free Oral-B toothbrush” lure and **IPv6-mapped IPv4 literals** (e.g., `http://[::ffff:5111:8e14]/` → `81.17.142.20`) to obfuscate scam infrastructure and route victims to rotating landing pages aimed at stealing **PII and payment card data**—a distinct fraud technique from the sextortion emails but similarly focused on social engineering and monetization.
Jul 12, 2026
ShinyHunters has broadened its operations from data theft into a wider cloud-focused extortion campaign targeting enterprise SaaS and identity platforms, with reported intrusions involving **Okta**, **Salesforce**, cloud management systems, and CI/CD environments. Public reporting links the group to phishing, **vishing**, brute-force activity, exploitation of internet-facing applications including `CVE-2021-35587` and the Oracle PeopleSoft zero-day `CVE-2026-35273`, abuse of OAuth tokens, and theft of assets such as BrowserStack API keys that could enable supply-chain compromise. Researchers also reported insider recruitment efforts aimed at personnel with access to Okta, Microsoft SSO, Citrix VPN, GitHub, and GitLab, while the group allegedly uses leak sites and services such as LimeWire to pressure victims into seven-figure payments or sell stolen datasets. The FBI separately warned that ShinyHunters claimed responsibility for a disruptive attack on an online Learning Management System used by educational institutions and students across the United States, underscoring the group’s reach beyond traditional enterprise victims. According to the alert, the actors specialize in large-scale breaches and extortion and may follow intrusions with extortion emails, threatening texts, phone calls, impersonation, spearphishing, and even swatting, sometimes falsely claiming to hold compromising material. MITRE and industry reporting also associate ShinyHunters with aliases including **UNC6240** and **Bling Libra**, ties to **The Com** and overlaps with **Scattered Spider**, and note signs the group may be moving toward ransomware through a reported `shinysp1d3r` platform with ESXi encryption capability.
Aug 10, 2026