Anatomy of a sextortion scam
Summary: Cisco Talos analyzed two sextortion spam campaigns using "Aaron Smith" sender addresses that ran from Aug. 30 and Oct. 5, 2018, drawing on 233,236 emails sent from 137,606 unique IP addresses to 15,826 distinct recipients. The messages paired a password or phone number harvested from a public data breach with a $1,000 to $7,000 bitcoin demand, and 83 of the 58,611 unique wallets received payments totaling 23.3653711 bitcoins, worth $146,380.31.
Key Takeaway: The scam worked without any compromising video at all: a leaked password was enough to convince victims to send $146,380 in bitcoin in roughly 60 days, and the same wallets reappeared in unrelated extortion schemes, including a fake hitman plot.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026