The subject line is designed to stop your thumb: I have to share bad news with you. The body piles on remote-control malware, adult sites, a 48-hour clock, and a “fair deal” — transfer about $950 in Bitcoin and the “dirty stuff” vanishes. The wallet address changes from wave to wave. The script does not.
Security agencies and researchers have tracked this template for years. The UK National Cyber Security Centre (NCSC) and others note the same tells: a password lifted from an old breach, no proof of a real video, and a plea not to contact police. Sophos, SANS Internet Storm Center samples, and similar write-ups show most wallets earn nothing — a few receive enough that the spam stays profitable. Paying does not delete a file that was never filmed; it marks you as someone who responds.
Do not reply. Do not send crypto. If the mail quotes a password you still use, change it and turn on two-factor authentication. Report the message through your usual suspicious-email route, then delete it. If fear is already loud, talk to someone you trust offline — the isolation line in the email is part of the trick.
If you already paid, contact the exchange or bank used for the transfer and start at Get help. Ignore anyone selling a paid “blackmail cleanup” for another fee; see Fake recovery.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.