Scammers impersonate ShinyHunters in new sextortion email campaign

Following insights from Bleeping Computer, threat actors are leveraging email addresses exposed in data breaches, previously leaked by the ShinyHunters extortion group, to perpetrate a new sextortion email campaign demanding $2,000 in Bitcoin.

These fraudulent emails falsely claim to originate from ShinyHunters, asserting that the attackers compromised recipients' devices after obtaining their email addresses from breached company databases. However, investigations suggest these messages are sent by unrelated threat actors who have repurposed data leaked by ShinyHunters. The campaign has been observed using email addresses from breaches affecting companies such as Amtrak, Hallmark, Substack, and Betterment. While the use of a known leaked email address lends a false sense of legitimacy, there is no evidence that the senders have actually compromised recipients' devices, installed malware, accessed cameras, or monitored online activity. The ShinyHunters group itself has denied any involvement in this sextortion scheme. The emails typically claim to have gained access to devices, recorded visits to adult websites, and threaten to release compromising material to friends and family unless a Bitcoin ransom is paid within 48 hours. Security experts emphasize that these are common extortion tactics and recipients should not pay or respond to the sender, as the claims of device compromise are unsubstantiated.

Source: Bleeping Computer