Bitcoin Scam Letter Tactics: Hacker Surveillance and Vile Voyeurism

An email titled “Payment from Your Account” caught my eye. Although I knew it was probably another scam, who can resist a subject line like that?

If even the author couldn’t resist opening such an email, you can easily imagine how many people with no cybersecurity awareness would fall straight into the hacker syndicate’s trap.

In the article “Bitcoin Scam Case: You’ve Been Hacked—Pay the Ransom to Get Your Secrets Back!,” the author introduced a similar case. That one was probably a pure English email sent by Westerners; this time it’s the first time I’ve received a Simplified Chinese version of a scam letter.

It seems foreign scam syndicates have once again been copied by the other side of the strait.

Scam Email Header

Below is the header information of the scam email. Although the sender’s email address must be fabricated, this scammer was quite creative—he used a source from mainland China’s “Gengdan Institute of Beijing University of Technology.”

Using an academic network address not only makes it easier for mail servers to trust and possibly evade blocklists, but also makes it easier for us recipients to let our guard down (not really).

“Payment from Your Account” scam email

In fact, the sender relayed it through an intermediary server located in the French Republic (France for short), with the IP address 176.172.6.164 (see the excerpt below). So this letter wasn’t necessarily sent from the other side of the strait.

Received-SPF: none (176.172.6.164 is neither permitted nor denied by domain of gengdan.edu.cn) client-ip=176.172.6.164; envelope-from=[email protected]; helo=rch85-h04-176-172-6-164.dsl.sta.abo.bbox.fr;

Below is the content of this Bitcoin scam letter. The author fully reveals it for everyone to enjoy as a story.

In fact, the entire text is well-written with a complete narrative arc, and it has considerable reference and learning value.

Of course, the email address and Bitcoin address mentioned in the text have already been replaced. You can all safely transfer your Bitcoin to me (?).

Full Text of the Bitcoin Scam Letter

Hello! I have bad news for you. About a few months ago, I gained access to the electronic device you use to go online. Since then, I’ve been monitoring your every move on the internet. Here’s the whole story:

Not long ago, I bought access to some email accounts from hackers (buying such things on the internet is easy these days). Obviously, I logged into your email account (???@???.com.tw) very easily. A week later, I installed a Trojan virus in the operating systems of all the devices you use to check your email. This process wasn’t actually difficult (because you opened the links in the emails you received without hesitation every time). All the tricks are actually simple. =)

This virus software gives me access to all the input devices on your electronic devices (for example, your microphone, camera, and keyboard). I’ve already downloaded all your information, data, photos, and web browsing history to my server. I can access all your chat software, social networks, email, chat records, and contacts. My virus software constantly refreshes its signature (it’s driver-based), so antivirus software can’t detect it. Likewise, I think you now understand why you didn’t notice me before I sent you this email…

While collecting your information, I discovered that you really enjoy browsing adult websites. You love visiting porn sites and watching those exciting videos, getting a lot of pleasure from them. And I successfully recorded some of your lewd scenes and edited several montage videos showing how you masturbate and reach orgasm.

Don’t doubt it—with just a few clicks of the mouse, I can share all these videos with your friends, colleagues, and relatives. I’m not averse to the idea of making them public directly either. I think you definitely don’t want that to happen, because considering the kind of videos you like to watch (you know exactly what I mean), it would be a disaster for you.

This can be resolved like this: you transfer 10,000 yuan to me (converted to Bitcoin at the exchange rate at the time of transfer), and once I receive this payment, I’ll immediately delete all this lewd stuff.

After that, we can forget each other. I also guarantee I’ll delete all the malware from your electronic devices. Trust me, I’m a man of my word. This is a fair deal, and considering the bandwidth I’ve spent these past months viewing your personal data, this price is already very low. If you don’t know how to buy and transfer Bitcoin, please use a modern search engine.

Here is my Bitcoin wallet address: “1QFHn1ubb7jDgWn3nYReMnmxAS87mc4ZMA”. Counting from when you opened this email, you have less than 48 hours to process this transfer (2 days).

Things you should not do:

• Don’t reply to this email (I created this email directly in your inbox and randomly generated a reply address).
• Don’t try to contact the police or other security services. Also, don’t tell your friends about this. If I find out you’ve done this (as you can see, it’s really easy, because I can control all your systems)—your videos will be made public immediately.
• Don’t try to find me—it’s completely pointless. All cryptocurrency transfers are anonymous.
• Don’t try to reinstall the operating system on your devices or throw them away. This is also pointless, because all the videos have already been saved on remote servers.

Things you don’t need to worry about:

• I can’t receive your transfer. - Don’t worry, once you complete the transfer, I’ll see it immediately, because I’m monitoring your every move at all times (my Trojan virus has remote control capabilities, similar to TeamViewer software).
• Even if I receive the payment, I’ll still make your videos public. - Trust me, I have no reason to keep causing you trouble. If I really wanted to do that, I would have done it long ago! Everything will be done fairly! And one more thing… don’t get into a similar situation again! My advice—frequently update all your!

Further Reading

1. Cybersecurity: Design a “good password” to protect your online security and privacy (expert rules tutorial)
2. Malicious scam website of the Bitcoin QRCode generator