Operating System
Other Operating System (Specify in thread)
Infection date and initial symptoms
Two weeks ago, with pop up ads. Then I experienced pop up web pages to crypto.newsspace.com. I now have a threatening email from myself saying that they have hacked my phone and personal information.
Current issues and symptoms
Pop up webpage in chrome called crypto.newsspace.com .
Steps taken in order to remove the infection
Tried to delete unknown apps, disabled notifications, downloaded various apps that did not detect the issue at all.
System logs
I did not upload the FRST.txt logs

Chillysea21

New Member
About two weeks ago I began seeing pop up ads on my phone. I have basic knowledge on how to remove viruses on PC computers through system restore, but this is something more complex. As I am typing this I am experiencing pop ups in Google chrome from a site called crypto.newsspace.com. I tried to find apps that may have been installed without my permission, but couldn't find it. So, I deleted apps that I thought may be the issue. Today I received an email from my own email, from someone who hacked my email and has threatened to blackmail me by sending videos to my contacts for a large sum of money. I will attach screenshots of the email. Please help, I do not know what else to do. Malwarebites and other virus apps cannot detect it.
 

Attachments

Reactions: oldschool

Chillysea21

New Member
Indeed, however on continuously getting pop ups on Google chrome from a bitcoin site. It's very annoying.
Here is the link that keeps popping up: https://crypto-news.space/en/crypto-currency/worlds-largest-crypto-exchange-binance-looks-to-add-new-stablecoins/attachment/23584102_10155167717567615_1815997961_o/#ad
 
Last edited by a moderator:
Reactions: oldschool

aag14

New Member
I have the same problem with constantly popping up "crypto-news.space" tabs in chrome as well as with popping up app windows titled "Promotion". While doing backup I accidentally found a folder /Phone/Android/data/com.instagram.android/cache/ExoPlayerCacheDir ,
described here: Quick and Dirty — Exploit Analysis — Stagefright.H!Gen. They say it might be very risky and that it comes potentially via instagram, through links and/or videos.
 
Reactions: oldschool