{
  "slug": "password-sextortion",
  "canonical_name": "\"I know your password\" sextortion emails",
  "family": "sextortion",
  "impersonates": {
    "brand": null,
    "disclaimer": null,
    "official_fraud_page": null
  },
  "goal": [
    "crypto"
  ],
  "channels": [
    "email"
  ],
  "summary": "An email opens with one of your real, old passwords from a data breach, claims malware recorded you through your webcam while you watched adult sites, and demands Bitcoin within a deadline. There is no video and no malware; the password came from a breach dump. Skins on record: the 2018 \"porn blackmail\" wave, \"Save Yourself\" (2019) and \"ChaosCC hacker group\" (2019).",
  "status": "active",
  "first_seen": "2018-10",
  "last_seen": null,
  "recognise": [
    "A password you recognise — usually an old one",
    "A claim of a webcam recording, never any proof",
    "A Bitcoin address and a deadline of one or two days",
    "Threats to send the \"video\" to your contacts"
  ],
  "variants": [
    {
      "subject": "I do know {password} is your password",
      "first_seen": "2018-10",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/porn-blackmail-email-scam"
      ]
    },
    {
      "subject": "Save Yourself",
      "first_seen": "2019-08",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/save-yourself-email-scam"
      ]
    },
    {
      "subject": "Your account has been hacked by ChaosCC hacker group",
      "first_seen": "2019-09",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/chaoscc-hacker-group-email-scam"
      ]
    }
  ],
  "specimen": {
    "date": "2018-10",
    "channel": "email",
    "from": null,
    "reply_to": null,
    "subject": null,
    "attachment": null,
    "body_text": "I do know [password] is your password. You don't know me and you are most likely wondering why you are getting this email, right?\n\nWell, I actually set up a malware on the adult videos (pornographic material) website and there's more, you visited this site to have fun (you know what I mean). While you were watching videos, your browser initiated functioning as a RDP (Remote Desktop) that has a keylogger which provided me access to your display and also cam. After that, my software program collected your complete contacts from your messenger, social networks, as well as email. [continues with a Bitcoin demand and a deadline]",
    "redactions": [
      "password",
      "Bitcoin address",
      "amount"
    ],
    "image": "/wp-content/uploads/porn-blackmail-email-spam.png",
    "sources": [
      "https://soft2secure.com/knowledgebase/porn-blackmail-email-scam"
    ]
  },
  "tells": [
    {
      "n": 1,
      "anchor": "body",
      "text": "The password is real but old — it comes from a breach dump, not from your computer"
    },
    {
      "n": 2,
      "anchor": "body",
      "text": "Technical word salad (\"RDP with a keylogger\") that describes nothing real"
    },
    {
      "n": 3,
      "anchor": "body",
      "text": "Payment only in Bitcoin, only within a deadline"
    }
  ],
  "indicators": {
    "sender_domains": [],
    "senders": [],
    "reply_to": [],
    "phone_numbers": [],
    "urls": [],
    "wallets": [],
    "attachments": [],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not pay, do not reply — there is no video",
      "If the password is one you still use anywhere, change it there now and turn on two-factor authentication",
      "Report it and delete it"
    ],
    "if_called_or_paid": [
      "If you paid, report it to IC3 or your national fraud centre with the Bitcoin address; the payment cannot be reversed but the address can be tracked",
      "Do not engage further; they will ask for more"
    ],
    "report_links": [
      {
        "label": "Report to FBI IC3",
        "url": "https://www.ic3.gov/"
      },
      {
        "label": "Report to the FTC",
        "url": "https://reportfraud.ftc.gov/"
      },
      {
        "label": "Action Fraud (UK)",
        "url": "https://www.actionfraud.police.uk/"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2019-09-04",
      "type": "specimen",
      "title": "Specimen №3: \"ChaosCC hacker group\"",
      "text": "A skin that borrows the name of a real hacker collective for credibility; same demand.",
      "added": [],
      "removed": [],
      "sources": [
        "https://soft2secure.com/knowledgebase/chaoscc-hacker-group-email-scam"
      ]
    },
    {
      "date": "2019-08-06",
      "type": "specimen",
      "title": "Specimen №2: \"Save Yourself\", with a \"drive-by exploit\" story",
      "text": "Adds a claim that the recipient's browser was infected by a \"drive-by exploit\"; the password hook is the same.",
      "added": [],
      "removed": [],
      "sources": [
        "https://soft2secure.com/knowledgebase/save-yourself-email-scam"
      ]
    },
    {
      "date": "2018-10-03",
      "type": "specimen",
      "title": "Specimen №1: the first password-led wave",
      "text": "The template quoted above: a breached password, a webcam story, Bitcoin.",
      "added": [],
      "removed": [],
      "sources": [
        "https://soft2secure.com/knowledgebase/porn-blackmail-email-scam"
      ]
    },
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Grew out of three guides (2018–2019), all online unchanged. The template still circulates with new passwords from newer breaches.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [],
  "sources": [
    "https://soft2secure.com/knowledgebase/porn-blackmail-email-scam",
    "https://soft2secure.com/knowledgebase/save-yourself-email-scam",
    "https://soft2secure.com/knowledgebase/chaoscc-hacker-group-email-scam"
  ],
  "legacy_urls": [
    "/knowledgebase/porn-blackmail-email-scam",
    "/knowledgebase/save-yourself-email-scam",
    "/knowledgebase/chaoscc-hacker-group-email-scam"
  ],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/password-sextortion",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}