You have been hacked…Microsoft sextortion email scam

Hello pervert, I’ve sent this message from your Microsoft account.
If in doubt delete.

Zero Trust Policy

What is Sextortion? 

Sextortion is social engineering blackmail scam using fear of one’s privacy to extort bitcoin ransom. Don’t fall for it. Don’t Panic.

Phish Sextortion takes advantage of your fear that your most private moments will be exposed to the public. It usually starts with an email. The hacker or phisher by using fear misleads you into believing they have gained access to your computer, your files, your browsing habits and hardware like microphone and webcam. Porn sites are a business and will not give out your credentials or viewing habits of their visitors as this would greatly affect their business model. It is very difficult to take control of one individual’s hardware and then extort them. This model like many phish scams is aimed far and wide in the hope at least of few of the 1000s emails will panic, react and take the bait. Don’t fall for it. Don’t Panic.

You have been hacked…Microsoft sextortion email scam

Hello pervert, I’ve sent this message from your Microsoft account.
If in doubt delete.

The scammer does not have access to your computer otherwise he would greet you with your name! Please note the use of time based threats to force you into fear based response.
If you are watching porn, don’t as porn is mostly violent, exploitive and really bad for your karma/spirit.

Email spoofing is a common technique that scammers use to send emails with a fake or forged sender address, making it appear as though the email is coming from the recipient’s own email address. This is commonly seen in spam, phishing, and sextortion emails, where scammers try to create a sense of urgency and fear by making you believe your computer or account has been hacked.

You have been hacked…Microsoft sextortion email scam

Hello pervert, I’ve sent this message from your Microsoft account.
If in doubt delete.

Email spoofing occurs when an attacker forges the “From” field in the email header, making it appear that the email is coming from someone else, often the victim’s own email address. This is con involving the email protocol and doesn’t require access to your email account. The Simple Mail Transfer Protocol (SMTP), which is used to send emails, doesn’t require authentication of the sender’s address, making it vulnerable to spoofing. Scammers exploit this by inputting any email address, even your own, in the “From” field when sending the message. Why does it look like your email? Scammers use your own email address in both the “From” and “To” fields to make you believe that the email is coming from your own account, reinforcing the claim that you’ve been hacked.

Sextortion emails usually claim that a hacker has compromised your computer, recorded you through your webcam, or obtained embarrassing personal information. The scammer threatens to release this information unless you pay a ransom, in this case 1750$ to my Litecoin (LTC) wallet: ltc1qzwfyj5tw2qm8un08gvf4263x6f59eq59vvcktj. The scammers make it look like you have been hacked by sending the emails as if it’s from your own account (through spoofing), the scammer tries to convince you that they have full control of your email or device, even though they do not. Sometimes scammers may include a password you’ve used in the past (often obtained from a data breach) to make the threat seem more credible. Scammers sometimes mention well-known services like Microsoft, Amazon or Netflix to increase the perceived credibility of the threat. But in reality, these emails are not an indication that your Microsoft account or any other account is compromised. It’s simply a scare tactic using email spoofing.

Check email headers as the technical details of the email (accessible in your email client’s “View Source” or “Show Original” function) can show the real source of the email, revealing that it didn’t actually originate from your account. Moreover, inconsistent domains, the email will show a fake “From” address, but the domain used to send the email may not match legitimate domains like Microsoft’s or your own. If the email makes alarming claims about hacking, uses threatening language, or demands ransom, it’s almost certainly a scam.

Please be aware of SMTP’s design flaw allowing spoofing because it doesn’t verify sender addresses by default and Authentication protocols like SPF, DKIM, and DMARC can help reduce spoofing but aren’t foolproof. SMTP, the protocol responsible for sending emails, is designed in a way that doesn’t validate the sender’s email address by default. This was ok when the internet was trivial, but it’s now widely exploited by spammers and scammers.

What to Do:
Use SPF, DKIM, and DMARC email authentication mechanisms to help reduce email spoofing by verifying that emails claiming to come from your domain are actually sent by authorised servers. If you receive a sextortion or phishing email, don’t engage with it. The scammer likely has no real information about you.
Change Passwords if the email includes a real password that you’ve used before, change it immediately and ensure you use strong, unique passwords for different accounts.
Enable Two-Factor Authentication (2FA) for better security, ensure that you have 2FA enabled on your email and other important accounts to protect against unauthorized access. Sextortion scams rely on scare tactics and false claims of hacking, often trying to exploit old passwords or other personal data from breaches. Keep all software up to date like browsers, scan your devices often, use different passwords and change them regularly and use security products Zone Alarm anti-virus, firewall and anti-hacking features.