What is the “Have you heard about Pegasus” email

“Have you heard about Pegasus” email is classified as a sextortion scam. It makes false claims of users’ computers being infected with malware and threatens to release non-existent videos.

 

 

The email falls into the sextortion email scam category because it threatens to release non-existent sexual videos of users if they do not agree to pay. The “Have you heard about Pegasus” email is a classic example of a sextortion scam and follows the same patterns. The majority of sextortion emails are more or less identical to one another despite being operated by different malicious actors, with only the contents of the email slightly differing.

The “Have you heard about Pegasus” email begins by asking whether the recipient has heard about the Pegasus malware. The sender proceeds to introduce themselves as some kind of “blackhat hacker” and claims that they were able to infect the recipient’s phone with the Pegasus malware using a “zero-click” attack. Supposedly, the recipient did not need to click on any malicious link for the phone to get infected.

The malware supposedly allowed this “hacker” complete access to the user’s device. They were then supposedly able to steal personal information, including messages (both SMS and social media), photos, emails, etc., as well as record phone calls and activate the camera and the microphone. This supposedly allowed the sender to spy on the user and make videos of them during their “private moments”. The sender threatens to send the non-existent videos to all contacts unless the user agrees to pay 0.035 Bitcoin, which is $2280 at the moment.

While the email and its contents are completely fake, Pegasus malware does exist. The malware can be installed on iOS and Android devices, and while it was developed by a legitimate company for fighting crime and terrorism, it’s often used by governments to spy on various people (e.g. human rights activists or journalists). Scammers behind this “Have you heard about Pegasus” email are purposely using the name of an infamous malware so that when potential victims research the malware, they get results claiming it’s a legitimate and dangerous infection.

The email is written using threatening language to scare the recipient. Many sextortion emails also mock the users and try to shame them for their supposed pornography-watching habits. This is a tactic to pressure the user into paying the requested sum of money. But paying would be a complete waste of money because this email is nothing more than a scam.

Below is the complete “Have you heard about Pegasus” email:

Hello, I’m going to share important information with you.
Have you heard about Pegasus?
You have become a collateral victim. It’s very important that you read the information below.

Your phone was penetrated with a “zero-click” attack, meaning you didn’t even need to click on a malicious link for your phone to be infected.
Pegasus is a malware that infects iPhones and Android devices and enables operator of the tool to extract messages, photos and emails,
record calls and secretly activate cameras or microphones, and read the contents of encrypted messaging apps such as WhatsApp, Facebook, Telegram and Signal.

Basically, it can spy on every aspect of your life. That’s precisely what it did.
I am a blackhat hacker and do this for a living. Unfortunately you are my victim. Please read on.

As you understand, I have used the malware capabilities to spy on you.
And by that I mean that I have collected your parts of your private life.

My only goal is to make money. And I have perfect leverage for this.
As you can imagine in your worst dream, I have videos of you exposed during the most private moments of your life, when you are not expecting it.

I personally have no interest in them, but there are public websites, that have perverts loving that content.
As I said, I only do this to make money and not trying to destroy your life. But if necessary, I will publish the videos.
If this is not enough for you, I will make sure your contacts, friends and everybody you know see those videos as well.

Here is the deal. I will delete the files after I receive 0.035 Bitcoin (about 1600 US Dollars).
You need to send that amount here 1AXNYLDEG5YEzc2eyUh7SUYYKeRUaRwseu

I will also clear your device from malware, and you keep living your life.
Otherwise, shit will happen.

The fee is non negotiable, to be transferred within 2 business days.

Obviously do not try to ask for any help from anybody unless you want your privacy to be violated.
I will monitor your every move until I get paid. If you keep your end of the agreement, you wont hear from me ever again.
Take care.

How did scammers get my email address?

Malicious actors and scammers use various scare tactics to pressure users into paying. Claiming that they obtained the user’s email address via hacking is one of them. In reality, scammers buy email addresses from hacker forums where they end up after being leaked. Email addresses get leaked all the time, whether because of a cyberattack or a company accidentally leaking its users’ data. Leaked email addresses and other personal information are sold on hacker forums to other malicious actors.

Some sextortion emails also expose users’ passwords, ones that users use. This is a particularly effective tactic because users who are unfamiliar with malicious scams would become convinced that their devices have been hacked. Because in their minds, how else would the sender have their password? The answer to that is very simple. Passwords end up in the hands of malicious actors the same way as email addresses, through data breaches/leaks. Many companies do not have adequate security measures and store users’ passwords in plain text. When these companies are breached in a cyberattack, the passwords are stolen and later sold on hacker forums. Scammers operating sextortion scams buy this data and use it to scare users.

Remove “Have you heard about Pegasus” email

If you receive this email, you can just remove “Have you heard about Pegasus” email from your inbox. The same applies to all other sextortion emails. Pay no attention to the contents because the emails are nothing more than a scam.