Fake ShinyHunters emails threaten victims with fake footage

Published July 26, 2026

Fake ShinyHunters emails threaten recipients with fabricated webcam footage unless they pay $2,000 in Bitcoin. There is no evidence that these scammers accessed devices, cameras, or microphones.

Report priority
Medium
Targets
Amtrak+7 more

How it works

  • Scammers reuse email addresses from data leaks linked to ShinyHunters.
  • They claim those addresses helped them access devices and record private activity.
  • The evidence instead indicates unrelated scammers are impersonating ShinyHunters.

What to do

Do not reply, pay, click links, or open attachments. Change any reused credentials and enable two-factor authentication. Then report the message as spam or phishing and delete it.

Technical details

Affected software: Amtrak, Hallmark, ADT, Substack, Betterment, CarGurus, Panera Bread, McGraw Hill

The campaign repurposes email addresses from breach datasets associated with ShinyHunters. Reports found no evidence of malware, webcam or microphone access, recorded footage, or live device compromise.