So, today I received an email in my Gmail account which landed automatically in the spam folder. This was the email content:


As you may have noticed, I sent you an email from your account. This means that I have full access to your account: At the time of hacking your account(d*****@gmail.com) had this password: ******* (not revealed by me intentionally here)

You can say: this is my, but old password! Or: I can change my password at any time!

Of course! You will be right, but the fact is that when you change the password, my malicious code every time saved a new one!

I've been watching you for a few months now. But the fact is that you were infected with malware through an adult site that you visited.

If you are not familiar with this, I will explain. Trojan Virus gives me full access and control over a computer or other device. This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.

I also have access to all your contacts and all your correspondence from e-mail and messengers.

Why your antivirus did not detect my malware? Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent.

I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched. With one click of the mouse, I can send this video to all your emails and contacts on social networks. I can also post access to all your e-mail correspondence and messengers that you use.

If you want to prevent this, transfer the amount of $770 to my bitcoin address (if you do not know how to do this, write to Google: "Buy Bitcoin").

My bitcoin address (BTC Wallet) is: 1GB22WpNfFPcAYnad1Sd3qWoVJeDbtN72M

After receiving the payment, I will delete the video and you will never hear me again. I give you 48 hours to pay. I have a notice reading this letter, and the timer will work when you see this letter.

Filing a complaint somewhere does not make sense because this email cannot be tracked like my bitcoin address. I do not make any mistakes.

If I find that you have shared this message with someone else, the video will be immediately distributed. Bye!

Now, here are the few things I observed:

  • under from, my email address was written.
  • under to, that password (which is mentioned in the email) and my email address mentioned inside angular quotes.

Although that password which was mentioned in the email was my password around 4-5 years ago and I'm also not sure that whether it belongs to my Gmail account or some other account.

Now, my question is what should I do to tackle this situation? Should I simply ignore this email or report to Google or do something else? Please advise as I'm a bit worried on seeing this email.

Edit: I have changed my current account password as a security measure.

  • The from address on an email is easily spoofed. If you still use that password anywhere change it immediately, besides that there's not much to worry about (assuming it's not your current password to this email account). – AndrolGenhald Mar 28 '19 at 17:05
  • In addition to checking out the related question, here's some info from SANS Internet Storm Center on similar scams: isc.sans.edu/forums/diary/… – bonsaiviking Mar 28 '19 at 17:05
  • The email itself is a widely reported scam. It uses a list of previously stolen passwords from server compromises; your computer is fine, there is no "trojan" (at least not related to this email). But...why don't you know whether this is currently your password? And why are you using a compromised password on multiple accounts? Time to get a password manager! – Ben Mar 28 '19 at 17:18

No, this is nothing to worry about. They send out these types of emails to hundreds of people at a time, hoping that someone will take the bait and send them bitcoin. They don't actually have any information about you. If it's your current password, then reset it on sites that it's been used on. If it's just an old password, make sure it's not used anywhere else.

Reporting to Google wouldn't be a bad idea as they will start to flag emails like this one as spam to future recipients. Spoofing your from address isn't too hard unfortunately and some email providers don't add protections.

All in all, just make sure that password isn't used anywhere anymore and move on.

Not the answer you're looking for? Browse other questions tagged or ask your own question.