"I know your password" sextortion emails
An email opens with one of your real, old passwords from a data breach, claims malware recorded you through your webcam while you watched adult sites, and demands Bitcoin within a deadline. There is no video and no malware; the password came from a breach dump. Skins on record: the 2018 "porn blackmail" wave, "Save Yourself" (2019) and "ChaosCC hacker group" (2019).
- Arrives by
- First seen
- 2018-10
- Specimens
- 3
- Updated
- 2026-09-02
Right now the version you most likely received
How to recognise it
- A password you recognise — usually an old one
- A claim of a webcam recording, never any proof
- A Bitcoin address and a deadline of one or two days
- Threats to send the "video" to your contacts
What to do
- Do not pay, do not reply — there is no video
- If the password is one you still use anywhere, change it there now and turn on two-factor authentication
- Report it and delete it
Already called, clicked or paid? what to do in the next hour
- If you paid, report it to IC3 or your national fraud centre with the Bitcoin address; the payment cannot be reversed but the address can be tracked
- Do not engage further; they will ask for more
How it changed
2018 → 2019 · newest firstFamily created
Grew out of three guides (2018–2019), all online unchanged. The template still circulates with new passwords from newer breaches.
Specimen №3: "ChaosCC hacker group"
A skin that borrows the name of a real hacker collective for credibility; same demand.
Specimen №2: "Save Yourself", with a "drive-by exploit" story
Adds a claim that the recipient's browser was infected by a "drive-by exploit"; the password hook is the same.
Specimen №1: the first password-led wave
The template quoted above: a breached password, a webcam story, Bitcoin.
I do know [password] is your password. You don't know me and you are most likely wondering why you are getting this email, right?
Well, I actually set up a malware on the adult videos (pornographic material) website and there's more, you visited this site to have fun (you know what I mean). While you were watching videos, your browser initiated functioning as a RDP (Remote Desktop) that has a keylogger which provided me access to your display and also cam. After that, my software program collected your complete contacts from your messenger, social networks, as well as email. [continues with a Bitcoin demand and a deadline]
- 1 The password is real but old — it comes from a breach dump, not from your computer
- 2 Technical word salad ("RDP with a keylogger") that describes nothing real
- 3 Payment only in Bitcoin, only within a deadline
Same trick, other brands
- No related records yet. Browse the family →
Indicators
- None on record yet. Indicators change weekly; an empty list never means an email is safe.
In other streams
- Guide · Remove “ChaosCC hacker group” email scam2019-09
- Guide · Porn blackmail email scam making the rounds2018-10
- Guide · Save Yourself email scam – new Bitcoin phishing malware2019-08
- 3 subject lines on record: “I do know {password} is your password” · “Save Yourself” · “Your account has been hacked by ChaosCC hacker group”
Registry data
- Machine-readable
/scams/password-sextortion.json- Timeline feed
/scams/password-sextortion/feed.xml- Sources
- 3 · 1 change logged
- Licence
- CC BY 4.0 · attribution required
- Created / updated
- 2026-09-02 / 2026-09-02