I received an email today, stating that someone or group had installed something called Cobalt Strike Beacon on all of my devices, and if I didn't pay they were going to release the information that they had "downloaded" to their servers. The email says it's from ******@powerapps.com Any suggestions other than to in and change all of my passwords. Who should I pass this email onto? Thanks Here is a partial of the email: Greetings! I have to share bad news with you. Approximately a few months ago, I gained access to your devices, which you use for internet browsing. After that, I have started tracking your internet activities. Here is the sequence of events: Some time ago, I purchased access to email accounts from hackers (nowadays, it is quite simple to buy it online). I have easily managed to log in to your email account ******@outlook.com. One week later, I have already installed the Cobalt Strike "Beacon" on the Operating Systems of all the devices you use to access your email. It was not hard at all (since you were following the links from your inbox emails). All ingenious is simple. :). This software provides me with access to all your devices controllers (e.g., your microphone, video camera, and keyboard). I have downloaded all your information, data, photos, videos, documents, files, web browsing history to my servers. I have access to all your messengers, social networks, emails, chat history, and contacts list. My virus continuously refreshes the signatures (it is driver-based) and hence remains invisible for antivirus software. Likewise, I guess by now you understand why I have stayed undetected until this letter. While gathering information about you, i have discovered that you are a big fan of adult websites. You love visiting porn websites and watching exciting videos while enduring an enormous amount of pleasure. Well, i have managed to record a number of your dirty scenes and montaged a few videos, which show how you **** and reach orgasms. If you have doubts, I can make a few clicks of my mouse, and all your videos will be shared with your friends, colleagues, and relatives. Considering the specificity of the videos you like to watch (you perfectly know what I mean), it will cause a real catastrophe for you. I also have no issue at all with making them available for public access (leaked and exposed all data). General Data Protection Regulation (GDPR): Under the rules of the law, you face a heavy fine or arrest. I guess you don't want that to happen. Let's settle it this way: You transfer $1821 USD to me and once the transfer is received, I will delete all this dirty stuff right away. After that, we will forget about each other. I also promise to deactivate and delete all the harmful software from your devices. Trust me. I keep my word. That is a fair deal, and the price is relatively low, considering that I have been checking out your profile and traffic for some time by now. If you don't know how to purchase and transfer Bitcoin - you can use any modern search engine. You need to send that amount here Bitcoin wallet: 1LXXqKrRWSnFoXnN54Rwhrx1Z8kGX3aCRr (The price is not negotiable). You have 2 days in order to make the payment from the moment you opened this email. Do not try to find and destroy my virus! (All your data is already uploaded to a remote server). Do not try to contact me. Various security services will not help you; formatting a disk or destroying a device will not help either, since your data is already on a remote server. This is an APT Hacking Group. Don't be mad at me, everyone has their own work. I will monitor your every move until I get paid. If you keep your end of the agreement, you won't hear from me ever again. Everything will be done fairly! One more thing. Don't get caught in similar kinds of situations anymore in the future! My advice: keep changing all your passwords frequently. --- --- ---

Its an scam, simply change your password(s), and don't reuse them on multiplie sites.

Greetings from Belgium Brussels Europe, we get this kind of messages every week, but my wife and I do not care, we are protected by Intego VirusBarrier and NetBarrier but I must stay safe and cannot talk about the other security devices. Keep cool! JL Hello from Brussels too! Apparently the region is targeted at the moment. I got this email I really thought it was a virus for the first time in my life. It made me break out in a cold sweat. Glad to know it's a scam and to have come across this link. There is also this discussion with explanations from someone in the Microsoft team: https://answers.microsoft.com/en-us/outlook_com/forum/all/what-is-this-cobalt-strike-beacon-i-got-this-email/5637def1-3cae-4de8-bbe9-683bc2fe2239?page=1 The most clever is the purchase of the domain name with our email address, I do not know if I am the only one? Example, my email address is johndoe[at]domain . com The fraudulent email was support[at]johndoedomain . com Like he created the email just for me, so we believe it much faster. In reality it is possible and unfortunately to create mass e-mail addresses. I think they can't create mails with outlook or hotmail in the domain name (this must be blocked by security measure, reserved words), which would have been even scarier. ChatGPT's answer to this after asking this: Yes, it is quite possible to create mass email addresses using automated tools, which can be used in phishing or impersonation attacks. In the example you gave, the malicious person could have created a fraudulent email domain "mail.diegomaradona.com" and use bulk email addresses with this domain to send phishing emails. Courage to all, life is beautiful (I hope, because my two days period is not yet over)!

Hi, I received a similar email today, reported through my email vendor as a concern for their review. My plan was to ignore it since I thought it was a scam trying to scare me and force me to pay. However, I did some research and found this forum amongst other publications from technology and security vendors indicating this was a scam/phishing email. The only advice I can take from this scam/phishing email is to "keep changing all your passwords frequently", and I can add to enable any available MFA (multi-factor authentication) method whenever possible. Thanks all of you who have posted your case too.

Cobalt Strike "Beacon"

Anonymous

I received an email today, stating that someone or group had installed something called Cobalt Strike Beacon on all of my devices, and if I didn't pay they were going to release the information that they had "downloaded" to their servers. The email says it's from ******@powerapps.com Any suggestions other than to in and change all of my passwords. Who should I pass this email onto?

Thanks

Here is a partial of the email:

			Greetings!<br><br> <br><br>I have to share bad news with you. Approximately a few months ago, I gained access to your devices, which you use for internet browsing. After that, I have started tracking your internet activities.<br><br> <br><br>Here is the sequence of events:<br><br> <br>Some time ago, I purchased access to email accounts from hackers (nowadays, it is quite simple to buy it online). I have easily managed to log in to your email account ****@outlook.com.<br><br> <br><br>One week later, I have already installed the Cobalt Strike "Beacon" on the Operating Systems of all the devices you use to access your email. It was not hard at all (since you were following the links from your inbox emails). All ingenious is simple. :).<br><br> <br><br>This software provides me with access to all your devices controllers (e.g., your microphone, video camera, and keyboard). <br>I have downloaded all your information, data, photos, videos, documents, files, web browsing history to my servers. I have access to all your messengers, social networks, emails, chat history, and contacts list.<br><br> <br><br>My virus continuously refreshes the signatures (it is driver-based) and hence remains invisible for antivirus software. Likewise, I guess by now you understand why I have stayed undetected until this letter.<br><br> <br><br>While gathering information about you, i have discovered that you are a big fan of adult websites. You love visiting porn websites and watching exciting videos while enduring an enormous amount of pleasure. Well, i have managed to record a number of your dirty scenes and montaged a few videos, which show how you ** and reach orgasms.<br><br> <br><br>If you have doubts, I can make a few clicks of my mouse, and all your videos will be shared with your friends, colleagues, and relatives. Considering the specificity of the videos you like to watch (you perfectly know what I mean), it will cause a real catastrophe for you.<br><br> <br>I also have no issue at all with making them available for public access (leaked and exposed all data). <br>General Data Protection Regulation (GDPR): Under the rules of the law, you face a heavy fine or arrest. <br>I guess you don't want that to happen.<br><br> <br><br>Let's settle it this way:<br><br> <br>You transfer $1821 USD to me and once the transfer is received, I will delete all this dirty stuff right away. After that, we will forget about each other. I also promise to deactivate and delete all the harmful software from your devices. Trust me. I keep my word.<br><br> <br><br>That is a fair deal, and the price is relatively low, considering that I have been checking out your profile and traffic for some time by now. If you don't know how to purchase and transfer Bitcoin - you can use any modern search engine.<br><br> <br><br>You need to send that amount here Bitcoin wallet: <br>1LXXqKrRWSnFoXnN54Rwhrx1Z8kGX3aCRr<br><br> <br><br>(The price is not negotiable). <br>You have 2 days in order to make the payment from the moment you opened this email.<br><br> <br><br>Do not try to find and destroy my virus! (All your data is already uploaded to a remote server). <br>Do not try to contact me. Various security services will not help you; formatting a disk or destroying a device will not help either, since your data is already on a remote server.<br><br> <br><br>This is an APT Hacking Group. Don't be mad at me, everyone has their own work. <br>I will monitor your every move until I get paid. <br>If you keep your end of the agreement, you won't hear from me ever again.<br><br> <br><br>Everything will be done fairly! <br>One more thing. Don't get caught in similar kinds of situations anymore in the future! <br>My advice: keep changing all your passwords frequently.	<br>	---		<br>	---		<br>	---

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

This is a spam template sent to a lot of email accounts designed as a scare tactic. It's fake. In two of my email accounts, I've been receiving these off and on for years, and one of those accounts is only ever accessed from a PC that has no camera.

You can safely leave them in your spam folder. Report as spam/phishing if your email provider supports it. Also use this as an opportunity to revisit passwords on old accounts and change them. When possible, also setup two-step authentication methods (linked to your cell or email address) for all sensitive accounts, especially financial.

0 comments

Answer accepted by question author

Anonymous

I did absolutely nothing, and as far as I can tell no data was released. I did go through just to be safe and update all passwords, and login credentials, as some of them hadn't been changed in years.

0 comments

88 additional answers

Anonymous

2023-02-24T20:00:46+00:00

Its an scam, simply change your password(s), and don't reuse them on multiplie sites.
Was this answer helpful?

0 comments No comments
Anonymous

2023-02-15T11:42:09+00:00

Greetings from Belgium Brussels Europe, we get this kind of messages every week, but my wife and I do not care, we are protected by Intego VirusBarrier and NetBarrier but I must stay safe and cannot talk about the other security devices.

Keep cool!

JL

Hello from Brussels too! Apparently the region is targeted at the moment.

I got this email I really thought it was a virus for the first time in my life.
It made me break out in a cold sweat.
Glad to know it's a scam and to have come across this link.
There is also this discussion with explanations from someone in the Microsoft team: https://answers.microsoft.com/en-us/outlook_com/forum/all/what-is-this-cobalt-strike-beacon-i-got-this-email/5637def1-3cae-4de8-bbe9-683bc2fe2239?page=1

The most clever is the purchase of the domain name with our email address, I do not know if I am the only one?

Example, my email address is johndoe[at]domain . com
The fraudulent email was support[at]johndoedomain . com

Like he created the email just for me, so we believe it much faster.

In reality it is possible and unfortunately to create mass e-mail addresses.

I think they can't create mails with outlook or hotmail in the domain name (this must be blocked by security measure, reserved words), which would have been even scarier.

ChatGPT's answer to this after asking this:

Yes, it is quite possible to create mass email addresses using automated tools, which can be used in phishing or impersonation attacks.

In the example you gave, the malicious person could have created a fraudulent email domain "mail.diegomaradona.com" and use bulk email addresses with this domain to send phishing emails.

Courage to all, life is beautiful (I hope, because my two days period is not yet over)!
Was this answer helpful?

0 comments No comments
Anonymous

2023-02-10T00:03:46+00:00

Hi,

I received a similar email today, reported through my email vendor as a concern for their review. My plan was to ignore it since I thought it was a scam trying to scare me and force me to pay. However, I did some research and found this forum amongst other publications from technology and security vendors indicating this was a scam/phishing email.

The only advice I can take from this scam/phishing email is to "keep changing all your passwords frequently", and I can add to enable any available MFA (multi-factor authentication) method whenever possible.

Thanks all of you who have posted your case too.
Was this answer helpful?

0 comments No comments