A newly discovered malware strain called Varenyky is targeting users through fake invoice emails, secretly recording their screens during visits to adult websites and then demanding cryptocurrency payments to keep the footage private.
No matter how powerful your antivirus software claims to be, the internet is never entirely safe. The rapid pace of technological advancement works both ways, making it easier for attackers to find backdoors into personal devices. ESET, a well-established cybersecurity firm based in Slovakia, has uncovered a particularly invasive threat that does exactly that. The malware, dubbed Varenyky, takes screenshots and records the screen of anyone who visits adult content websites, turning private moments into leverage for extortion.
The virus was first detected in May, though its distribution method remained unclear for some time. ESET's research team has since confirmed that the impact is concentrated primarily in France. Varenyky infiltrates devices through a sophisticated antispam bot that has evolved specifically to avoid detection and removal from infected terminals. The approach is surgical rather than scattergun, which makes it harder to stop.
The attack begins with an email disguised as an invoice, written entirely in French, requesting a payment of 491 euros. Once the recipient interacts with the attached document, a message appears claiming the file is protected by Microsoft Word and requires human verification to open. It is a clever ruse. The moment the user complies and enables the macros, the device is compromised. As ESET's analysts explain, cybercriminals use spam with an illicit attachment disguised as a fake invoice. To open the file, the victim must pass a system check that supposedly confirms they are not a robot. Once that step is completed, the spyware executes its dangerous payload.
After installation, Varenyky gets to work quickly. It can steal saved passwords and access the victim's email accounts, giving the attackers a treasure trove of personal data. The malware then monitors browsing activity and begins recording the screen each time the user visits an adult website. Those recordings are subsequently sent to the victim's own contacts. ESET has already documented at least one case of sextortion involving a French victim. The hackers demanded 750 euros in bitcoin in exchange for not sharing the recordings. They also threatened to distribute the content to everyone in the victim's professional and personal circles if the payment was not made.
It is worth noting, as ESET has pointed out, that Varenyky can only record what appears on the infected device's screen. It does not activate the webcam. The cybersecurity firm also confirmed that, as of now, no stolen content captured through Varenyky has actually been released publicly. That detail matters. It suggests the attackers are primarily motivated by financial gain rather than public humiliation. As long as there is a chance of payment, they have little incentive to follow through on their threats.
Even so, the psychological pressure of such a threat is enormous, and many victims may choose to pay rather than risk exposure. Prevention remains the strongest defense here. Be skeptical of unexpected invoices, never enable macros in documents from unknown sources, and keep your security software current. The tactics behind Varenyky are not revolutionary, but they are effective precisely because they exploit human behavior and embarrassment rather than technical vulnerabilities. Expect more attacks of this nature as attackers refine their social engineering techniques.
