Loading story…
A wave of threatening email campaigns is using intimidation and recycled data to pressure recipients into paying attackers. One campaign sent sextortion emails demanding $2,000 in Bitcoin, falsely claiming the sender had hacked victims’ devices, activated cameras and microphones, and recorded visits to adult websites. Reporting indicates the messages relied on email addresses exposed in earlier ShinyHunters-linked data leaks, with criminals referencing companies associated with the recipient’s address to make the threats appear credible. Betterment said some customers received the emails and emphasized that possession of an email address alone does not give an attacker access to a device.
A separate warning from CERT Bulgaria described a campaign of threatening emails about allegedly planted explosive devices, underscoring a broader pattern of coercive messaging designed to trigger fear rather than reflecting confirmed compromise. Together, the incidents show how threat actors are repurposing previously leaked personal data and high-pressure hoax narratives to drive extortion and social engineering, while security authorities and affected organizations stress that recipients should treat the claims as fraudulent unless independent evidence shows an actual intrusion.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
CERT Bulgaria published a warning about a campaign involving threatening email messages. The reference indicates official awareness and public warning activity around the scam campaign.
A sextortion scam campaign began using email addresses exposed in prior ShinyHunters-related data leaks to send threatening emails demanding $2,000 in Bitcoin. The messages falsely claimed victims' devices were compromised and that intimate recordings would be released unless payment was made.
Betterment acknowledged that some of its customers received the threatening emails and said the messages were a common extortion scam. The company stated that knowing an email address alone does not let criminals install malware or access a device.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcegovcert.bg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sextortion email campaign is using real email addresses exposed in prior **ShinyHunters-linked** data breaches to make fraudulent threats appear credible and demand **$2,000 in Bitcoin**. The messages claim the sender compromised victims’ devices, installed malware, accessed cameras and microphones, and recorded visits to adult websites, then threaten to release supposed footage unless payment is made within 48 hours. Reporting found **no evidence** that the scammers had actual access to recipients’ devices or accounts. The campaign appears to be run by actors **impersonating ShinyHunters**, not by the extortion group itself, and relies on previously leaked data from breaches affecting organizations including **Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread,** and **McGraw Hill**. Some targeted addresses were confirmed to match leaked datasets, reinforcing the scam’s plausibility, while affected organizations such as Betterment warned customers that the messages are a common extortion attempt and advised recipients not to pay or respond.
Jul 28, 2026
A new wave of **sextortion emails** is using the familiar “Hello pervert”/“I recorded you” template, falsely claiming the recipient was infected via a *drive-by exploit* and recorded through their webcam. To increase credibility, the messages include a real password associated with the target and demand payment (e.g., **$800 in Bitcoin**) to prevent alleged video/data release; the password reuse strongly suggests sourcing from **previous data breaches** and credential dumps rather than any actual device compromise. Guidance for recipients emphasizes treating these messages as scams: **do not pay**, stop engagement, preserve evidence, and report to appropriate authorities (e.g., **FBI IC3** in the US). Separately, phishing activity impersonating **United Healthcare** has been observed using a “free Oral-B toothbrush” lure and **IPv6-mapped IPv4 literals** (e.g., `http://[::ffff:5111:8e14]/` → `81.17.142.20`) to obfuscate scam infrastructure and route victims to rotating landing pages aimed at stealing **PII and payment card data**—a distinct fraud technique from the sextortion emails but similarly focused on social engineering and monetization.
Jul 12, 2026
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026