QRCode Used in Extortion Spam Campaign

Sextortion is a form of sex-themed exploitation via email where victims are coerced to give money to the scammer. Sextortion campaigns have become a large issue in the last year. These email campaigns victimize users by informing them that they are being watched on their webcams or have been infected with malware from watching porn sites. Earlier this year, we even saw samples that came with a malicious downloader attachment.

Recently, we saw a new campaign arise, with the same intention of extortion, but with a new gimmick involving images and QR codes.

Our traps captured up to 15,000 per day indicating a large campaign.

The emails come with various subject lines composed of any of these words below and/or gibberish characters.

The e-mail format is shown below. Surprisingly unlike previous campaigns where everything is written either in bad English text or character embedded text, this time, the messages have three attached PNG picture files, with the Bitcoin address being the only text.

Examining each image, the first PNG picture file contains the extortion message, informing the recipient that their computer was hacked, there was malware installed on their computer, and their activities were recorded via keylogging and the webcam. Then scammers clearly ask for $650(USD).

The next image is a QR Code. This makes their attack unique from previous campaigns. Lately, these QR Codes act as a connector between the physical world and the web. When people see a QR code, they scan it, and are suddenly engaged in the message embedded in the code. That said, the extortionists are now using this technique in this campaign.

Below are several examples of the decoded message from the QR Code, which reveal Bitcoin information.

This follows a Bitcoin URL Scheme BIP21, with the syntax:

The last image contains the instructions, the time remaining to pay, and warning what the sender of the email can do if no Bitcoin payment was made in 48 hours.

We also noticed that these emails came from the same botnet source, in this case, we identified it as Necurs. This is a large botnet and, when active, has distributed massive volumes of malicious spam in the past. Necurs has clearly jumped on the sextortion bandwagon.

The Trustwave Secure Email Gateway detects and blocks these campaigns at the gateway. We also recommend that customers educate employees to not respond to these messages or transfer any money. If you happen to receive an extortion email demanding Bitcoins the chances of it being real are remote indeed.