Pervert Scam Email Pegasus

Reported
Anonymous
2024-08-05T19:10:24+00:00

Hi there

I received an email at 05:56 today stating that I had had Pegasus spyware installed on my PC and that explicit videos of me would be shared with my contacts unless I paid a virtual currency ransom.

I did find it in my junk folder, but I still wanted to reach out as this email has caused me a great deal of anxiety. I have viewed online forums that state the email is a common scam, and that there are others similar to it in circulation, but I would still appreciate an expert opinion.

Also it was send with my email, and outlook detect it like it was me

For person that face the same problem

You can check the source code of the email and see if fsp fails, that mean that the guy spoofed the email so you are not hacked guys

It look like this

protection.outlook.com: domain of hotmail.com does not designate 95.214.82.181 as permitted sender

Outlook | Web | Outlook.com | Email

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2024-08-06T03:34:45+00:00

Hi NEVARLeVrai,

Thank you for using Microsoft products and posting in the community.

I know you're worried about your email being hacked. Here are some suggestions to help you deal with this situation and keep your device safe:

  1. Do not respond or pay

First and foremost, do not respond to the threatener or make a payment to them. Such emails are usually phishing or blackmail, designed to intimidate you for money.

  1. Confirm the authenticity of the email

Check the sender's address: Double-check the sender's email address to make sure it matches your email address exactly. Sometimes, attackers forge sender information.

Check the header information: If you know how to view the full header information of an email, you can check if the email is really from your domain.

  1. Change your password

Change your Microsoft account password immediately. Make sure you choose a strong password and enable double authentication (2FA) for added security.

Check other accounts: if you use the same password for other websites, it is recommended that you change these as well.

  1. Check device security

Run a security scan: Use a trusted antivirus program to run a full scan of your device. Make sure your antivirus software is up to date.

Check applications: See if there are any unidentified applications or files on your device, especially recently installed ones.

  1. Monitor Account Activity

Check Account Activity: Sign in to your Microsoft account and review recent sign-in activity to make sure there aren't any suspicious sign-ins.

Check other important accounts: Check the activity of your banking, social media, and other important accounts to ensure there is no unauthorized access.

  1. Report an Incident

Contact local law enforcement: If you feel threatened or are concerned about your safety, consider reporting it to your local law enforcement agency.

  1. Understanding Pegasus spyware

How to check for infections: Detecting Pegasus spyware isn't easy, but there are a number of security tools you can try to scan for it.

Keep your device up-to-date: Make sure your operating system and applications are kept up-to-date to prevent known vulnerabilities from being exploited.

I hope these programs can help you.

Best regards

Jay | Microsoft Community Support Specialist

0 comments

118 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2025-03-25T18:17:39+00:00

    I just got the same email this morning. This is the source view stuff... and definitely a scam but still pretty scary when you first see it.

    Received: from CY8PR10MB6778.namprd10.prod.outlook.com (::1) by CY8PR10MB6442.namprd10.prod.outlook.com with HTTPS; Tue, 25 Mar 2025 11:11:51 +0000 Received: from DM6PR13CA0013.namprd13.prod.outlook.com (2603:10b6:5:bc::26) by CY8PR10MB6778.namprd10.prod.outlook.com (2603:10b6:930:99::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8534.42; Tue, 25 Mar 2025 11:11:50 +0000 Received: from DS3PEPF0000C37E.namprd04.prod.outlook.com (2603:10b6:5:bc:cafe::33) by DM6PR13CA0013.outlook.office365.com (2603:10b6:5:bc::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8534.43 via Frontend Transport; Tue, 25 Mar 2025 11:11:50 +0000 Authentication-Results: spf=softfail (sender IP is 194.190.211.108) smtp.mailfrom=outlook.com; dkim=none (message not signed) header.d=none;dmarc=fail action=none header.from=outlook.com; Received-SPF: SoftFail (protection.outlook.com: domain of transitioning outlook.com discourages use of 194.190.211.108 as permitted sender) Received: from ensnetworka.com (194.190.211.108) by DS3PEPF0000C37E.mail.protection.outlook.com (10.167.23.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8534.20 via Frontend Transport; Tue, 25 Mar 2025 11:11:49 +0000 X-IncomingTopHeaderMarker: OriginalChecksum:96AB51CD79CC13D43E928673E4216419A1EF25F7F2B31606B4BB6BC9E9B59564;UpperCasedChecksum:AFD1B3764D4BED2569F5E8368AD920BFA5B077215BBF313D2A16BA517CEF3128;SizeAsReceived:341;Count:7 Message-ID: <@outlook.com> From: "@outlook.com"

    Hello pervert, I've sent this mess=D0=B0ge from y= our Microsoft =D0=B0ccount.

    I w=D0=B0nt to inform you =D0=B0bout =D0=B0 very = b=D0=B0d situ=D0=B0tion for you. However, you c=D0=B0n benefit from it, if = you will =D0=B0ct wis=D0=B5ly.

    H=D0=B0ve you he=D0=B0rd of Peg=D0=B0sus? This is= =D0=B0 spyw=D0=B0re progr=D0=B0m th=D0=B0t inst=D0=B0lls on computers =D0= =B0nd sm=D0=B0rtphones =D0=B0nd =D0=B0llows h=D0=B0ckers to monitor the =D0= =B0ctivity of device owners. It provides =D0=B0ccess to your webc=D0=B0m, m= essengers, em=D0=B0ils, c=D0=B0ll records, etc. It works well on Android, i= OS, m=D0=B0cOS =D0=B0nd Windows. I guess, you =D0=B0lre=D0=B0dy figure= d out where I=E2=80=99m getting =D0=B0t.

    It=E2=80=99s been =D0=B0 few months since I inst= =D0=B0lled it on =D0=B0ll your d=D0=B5vi=D1=81=D0=B5s bec=D0=B0us= e you were not quite choosy =D0=B0bout wh=D0=B0t links to click on the int= =D0=B5rn=D0=B5t. During this period, I=E2=80=99ve le=D0=B0rned =D0=B0bout = =D0=B0ll =D0=B0spects of your priv=D0=B0te life, but =D0=BEn=D0=B5 is = of speci=D0=B0l signific=D0=B0nce to me.

    I=E2=80=99ve recorded m=D0=B0ny videos of you jer= king off to highly controversi=D0=B0l =D1=80=D0=BErn videos. Given th= =D0=B0t the =E2=80=9Cquestion=D0=B0ble=E2=80=9D genre is =D0=B0lmost =D0=B0= lw=D0=B0ys the s=D0=B0me, I c=D0=B0n conclude th=D0=B0t you h=D0=B0ve sick = =D1=80=D0=B5rv=D0=B5rsi=D0=BEn.

    I doubt you=E2=80=99d w=D0=B0nt your friends, f= =D0=B0mily =D0=B0nd co-workers to know =D0=B0bout it. However, I c=D0=B0n d= o it in =D0=B0 few clicks.

    Every number in your cont=D0=B0ct Iist will = suddenly receive these vid=D0=B5=D0=BEs =E2=80=93 on Wh=D0=B0tsApp, on Tele= gr=D0=B0m, on Inst=D0=B0gr=D0=B0m, on F=D0=B0cebook, on em=D0=B0il =E2=80= =93 everywhere. It is going to be =D0=B0 tsun=D0=B0mi th=D0=B0t will sweep = =D0=B0w=D0=B0y everything in its p=D0=B0th, =D0=B0nd first of =D0=B0ll, you= r f=D0=BErm=D0=B5r life.

    Don=E2=80=99t think of yourself =D0=B0s =D0=B0n i= nnocent victim. No one knows where your =D1=80=D0=B5rv=D0=B5rsi=D0=BEn migh= t le=D0=B0d in the future, so consider this =D0=B0 kind of deserved =D1=80u= nishm=D0=B5nt to stop you.

    I=E2=80=99m some kind of God who sees everything.= However, don=E2=80=99t p=D0=B0nic. As we know, God is merciful =D0=B0= nd forgiving,  =D0=B0nd so do I. But my m=D0=B5r=D1=81y = ;is not free.

    Tr=D0=B0nsfer 1650$ to my L= itecoin (LTC) w=D0=B0llet: ltc1qg0yepew7zxjlvj3wcr9kzug7g222m93zar9= ze9

    Once I receive confirm=D0=B0tion of the tr=D0=B0n= s=D0=B0ction, I will =D1=80=D0=B5rm=D0=B0nently delete =D0=B0ll v= ideos compromising you, uninst=D0=B0ll Peg=D0=B0sus from =D0=B0ll of your d= evices, =D0=B0nd dis=D0=B0ppe=D0=B0r from your life. You c=D0=B0n be sure = =E2=80=93 my benefit is only money. Otherwise, I wouldn=E2=80=99t be writin= g to you, but destroy your life without =D0=B0 word in =D0=B0 second.

    I=E2=80=99ll be notified when you open my em=D0= =B0il, =D0=B0nd from th=D0=B0t moment you h=D0=B0ve ex=D0=B0ctly 48= hours to send the money. If cryptocurrencies =D0=B0re unch=D0=B0r= tered w=D0=B0ters for you, don=E2=80=99t worry, it=E2=80=99s very simple. J= ust google "crypto exchange" or "buy Litecoin" =D0=B0nd= then it will be no h=D0=B0rder th=D0=B0n buying some useless stuff on Am= =D0=B0zon.

    I strongly w=D0=B0rn you =D0=B0g=D0=B0inst the fo= llowing:
    * Do not reply to this em=D0=B0il. I've sent it from your Micro= soft =D0=B0ccount.

    * Do not cont=D0=B0ct the police. I h=D0=B0ve =D0= =B0ccess to =D0=B0ll your d=D0=B5vi=D1=81=D0=B5s, =D0=B0nd =D0=B0s soon =D0= =B0s I find out you r=D0=B0n to the cops, videos will be published.<= /div> * Don=E2=80=99t try to reset or destroy your d=D0= =B5vi=D1=81=D0=B5s. As I mentioned =D0=B0bove: I=E2=80=99m monitoring =D0= =B0ll your =D0=B0ctivity, so you either =D0=B0gree to my terms or the vid= =D0=B5=D0=BEs =D0=B0re =D1=80ublished.

    Also, don=E2=80=99t forget th=D0=B0t cryptocurren= cies =D0=B0re =D0=B0nonymous, so it=E2=80=99s impossible to identify me usi= ng the provided =D0=B0ddr=D0=B5ss.

    Good luck, my perverted friend. I hope this is th= e l=D0=B0st time we he=D0=B0r from e=D0=B0ch other.

    And some friendly =D0=B0dvice: from now on, don= =E2=80=99t be so c=D0=B0reless =D0=B0bout your online security. --88763f937c88a2ac8f256c1f3bfe96a8e2ad--

    0 comments
  2. Anonymous
    2025-03-26T13:01:00+00:00

    Hey

    I too got the same type of email sent to my junk mail. It was sent on Sunday but I didn't see or look at it till today. I checked my sent mail but there was nothing I've sent to myself that I don't recognise. I just checked the message source and it said "Received-SPF: SoftFail (protection.outlook.com: domain of transitioning outlook.com discourages use of 212.192.56.78 as permitted sender)".

    I'm guessing this is safe to presume that this is a spoofed email and I have not been hacked?

    0 comments
  3. Anonymous
    2025-03-27T04:34:31+00:00

    Yup, your all good mate

    0 comments
  4. Anonymous
    2025-03-27T23:15:05+00:00

    Hi I have also received the same email, any help would be greatly appreciated

    0 comments