Child Porn Sextortion Scammers Pretending to be Microsoft Tech Support

We first warned readers back in March of 2018 that sextortion scammers were sending emails claiming to have hacked your computer and caught you watching porn. They then demanded bitcoin payments, else they would send videos of your actions to your friends and family. The claims were fake, there was no hacking, it was all a ruse to scare people into payment.

Now, security researcher Brian Krebs is warning of a new twist on this old scam – emails claiming that you have been caught watching child pornography and your Windows license is being suspended. The only way to undo this is to call the “Microsoft Support” included in the email. If you make the call, you’ll be taken through the standard tech support scam. The Microsoft imposters on the other end will ask you to allow them to take control of your computer, whereupon they will claim to have found all sorts of malware that they will be happy to fix for a fee. Like everything else in this scam, the malware isn’t real, and the “fix” is at best useless and, at worst, may contain malware from the scammers.

The wording of the sextortion email varies and, in some cases, may include an IP address and MAC address (device-specific identifier) that the scammers claim represent your computer (they don’t). You can confirm these are fake by checking your MAC address and IP address directly.

Here is one version flagged by Rowan University.

Subject: IP address blacklisted(Child Pornography Act 1996 violated)
From:  Mail Support
Body:

Hello,

We have found instances of child pornography accessed from your IP address. This is a punishable offence under The Child Pornography Prevention Act of 1996 . For now we are blacklisting your IP address and if there is any further action from Microsoft you will be informed via email.

If this was not you and you suspect potential hack or id theft contact Microsoft Support Team at 1-833-570-0309.

Microsoft Support
1-833-570-0309

And another reported by Brian Krebs.

We have found instances of child pornography accessed from your IP address & MAC Address.
IP Address: 206.19.86.255
MAC Address : A0:95:6D:C7

This is violation of Information Technology Act of 1996. For now we are Cancelling your Windows License, which means stopping all windows activities & updates on your computer.

If this was not You and would like to Reinstate the Windows License, Please call MS Support Team at 1-844-286-1916 for further help.

Microsoft Support
1 844 286 1916

My advice on this scam is clear – ignore it. The claims the scammers make about you watching child porn are not real, they do not have your computer or IP address details, and your Windows license is not being suspended. Whatever you do, do not call the number and allow the scammers to take control of your computer, nor should you make payment of any kind.

If you did fall for this scam, notify your credit card company to reverse any charges and report it to the Federal Trade Commission. It's also important to run a full anti-malware scan to remove any software the scammers may have installed on your PC; make sure Windows Defender is on, or download Bitdefender Total Security (paid) or AVG Antivirus (free).

[Image credit: Smartphone and keyboard via BigStock Photo]

News, Computers and Software, Computer Safety & Support, Blog, Privacy