"Surprised? I have yet another surprise for you" Email Scam

The "Surprised? I have yet another surprise for you" email scam is a social engineering-based attack that extorts money by threatening the release of a confidential video to the recipient's contacts. This tactic hinges on embarrassment over sexual activities and, as usual, asks for a ransom in a currency that's safe from refund attempts. Receivers of this message should delete the "Surprised? I have yet another surprise for you" email scam from their inbox, unopened, if possible.

A Surprise Tactic Pretending that It Knows Your Lovelife

Redditors are sharing examples of a new spamming campaign that's extorting Bitcoins over e-mail. The social engineering attack, the "Surprised? I have yet another surprise for you" email scam, leverages embarrassment over implied bedroom history. However, it uses a static template and appears that it's sending to individuals of randomly-harvested addresses without any respect for their past activities.

Like most of the social engineering tactics that malware experts see in general distribution against the public at large, this hoax is English-based, although it includes sufficiently unusual phrasings that it may be from an auto-translator. The message claims that the author recorded a video of private activities and collected the reader's contact list while they were in the bathroom. The story is a lead-in to the "Surprised? I have yet another surprise for you" email scam's goal of extorting one thousand, five hundred USD from the victim – unless they want the video released.

The "Surprised? I have yet another surprise for you" email scam asks for money in Bitcoin, which is a choice that prevents victims from getting refunds after realizing the con. Although malware experts have yet to trace the history of the associated wallet, many con artists will dedicate a specific account to each campaign that they refrain from using for any other activities. Bitcoin's instability means that a payment may vary, but, currently, it would amount to 0.26 BTC.

Pulling a Scheme Out of the Closet Forcefully

Most social engineering attacks require no defense that's more robust than ignoring them and deleting their messages, unread. However, some versions of the "Surprised? I have yet another surprise for you" email scam may come with additional security risks, such as drive-by-download exploits that the threat actor embeds in embedded content, attachments or links. Users can update their software, which will remove most vulnerabilities that aren't 'zero-day' and scan all and downloads with appropriate security utilities before trusting them.

Because its structure is decentralized and not government-backed, receiving refunds through Bitcoin requires both parties' consent and has no higher legal authority for appeal. The deadline that this tactic uses, which is similar to that of the also-recent "I hacked your device" email scam, forces victims into paying before thinking. Anyone using Bitcoin should remember the dangers and risks involved in these transactions before considering surrendering ransoms to an attack like the "Surprised? I have yet another surprise for you" email scam.

Some might say that the lesson that "Surprised? I have yet another surprise for you" email scam offers is that adults shouldn't engage in behavior they'd be ashamed of admitting to their families. Malware experts would emphasize the importance of not believing everything that you read.