You may have heard about those emails from scammers who say they have nude photos of you and try to get you to pay money to prevent their release. For a long time, those emails were just that: scams.
But now there’s a real threat. A new malware called Stealerium apparently knows when you’re viewing pornographic material in your browser and automatically takes snapshots of what you’re viewing and webcam photos of you in that moment. The malware then sends those recordings to cybercriminals who use them for blackmail.
Security researchers at Proofpoint have analyzed the malware and warn of a new escalation level in these so-called “sextortion attacks.”
Table of Contents
How Stealerium gets onto your PC
The Stealerium malware is spread via phishing emails that look deceptively genuine. The attackers disguise their emails as messages from reputable organizations (e.g., banks, streaming services, charities) and encourage recipients to open attachments or click on links.
These phishing emails take the usual scare tactics, generating a sense of urgency with subject lines “Payment Due,” “Court Summons,” and “Donation Invoice.” When you open said emails, the hope is you’re so alarmed that you’ve let down your guard, making it more likely that you’ll download attachments and/or click malicious links and buttons.
What makes Stealerium even more worrying is that its source code has been freely available on the internet via GitHub for years, allegedly for educational purposes. However, it’s only in recent months that Stealerium has been increasingly used in real-world attacks.
How the Stealerium malware works
Once infected, Stealerium exhaustively searches the PC for sensitive data, including passwords, credit card information, chat logs, and cryptocurrency accounts. Stealerium also monitors browser windows and recognizes certain keywords that you type.
With that latter function, Stealerium can recognize porn activity by detecting entries such as “porn” or “sex.” As soon as such content is detected, Stealerium takes screenshots of the content as well as photo snapshots using a webcam (if available). These files are then sent to the perpetrators via services like Discord, Telegram, or email.
Are you at risk of this malware?
Unlike a lot of extortion-based malware, which tend to attack companies and large organizations, the form of blackmail used by Stealerium specifically targets private individuals.
These scammers bank on the shame that their victims face, hoping it’ll be enough to extract payment out of them. Many who end up targeted by these sextortion attacks are afraid to report the crimes because they don’t want to explain how they got into the mess in the first place.
That’s exactly what these attackers are counting on. This inhibition threshold makes private users easy prey and explains why attacks like Stealerium are currently on the rise. The risk of detection is relatively low, and even small amounts of money can add up with lots of victims.
Unfortunately, everyone is at risk of sextortion attacks. Phishing scams can be easily automated and blasted out to millions of potential targets every day. No one is completely immune.
What can you do to protect yourself against webcam sextortion?
The most important way to protect yourself against Stealerium is to be extra, extra, extra careful when reading emails. Never download any attachments and never click on any links or buttons unless you’re 100 percent sure it’s safe. Even then, you’d be safer to never do it ever. Instead, manually type website URLs into your browser’s address bar instead of clicking, and double-check with senders (using a communication method other than email) for attachments.
It also helps to physically cover your webcam when it isn’t in use. Many laptops already have integrated sliders for their built-in webcams, and many external webcams also come with privacy covers now. If yours doesn’t have one, you can retrofit a webcam cover for cheap, or you can just put a sticker over your webcam.
Also, stay on top of regular software updates for your operating system, web browser, and antivirus software. This will help patch the latest known security vulnerabilities and attack vectors. If you don’t have antivirus yet, check out our top picks for PC antivirus software.
This article originally appeared on our sister publication PC-WELT and was translated and localized from German.