The “Have you heard about Pegasus?” email is usually a sextortion-style scam, not proof that Pegasus spyware is on your device. Scammers borrow the name of a real high-end spyware family to scare people into paying Bitcoin. The message often claims your camera, browser, contacts, or videos were captured, but provides no real evidence.
This is one branch of a wider sextortion playbook. For the general response steps, use our guide to sextortion scam signs and what to do first.
Should you pay the Pegasus email scam?
- No. Do not pay. Payment marks you as responsive.
- Do not reply. Save the message only if you need to report it.
- If it includes an old password, change that password anywhere it was reused.
- Scan your device if you opened attachments or installed anything.
| Scam type | Sextortion / spyware impersonation / Bitcoin demand |
| Main lure | Claims Pegasus spyware recorded you |
| Usually true? | No evidence; bulk extortion template |
| Safe action | Do not pay, change reused passwords, scan if files were opened |
Why Does the Pegasus Email Look Like It Came From Me?
The visible From address can be forged. Google explains that a spammer can put your address in the sender or reply-to field without creating the message inside your Gmail account.[1] Seeing your own address, your name, or “Me” is therefore not proof that the sender controls your mailbox, webcam, or phone.
Check independently: open your email provider’s official app or website, review recent security activity and signed-in devices, then inspect recovery details, forwarding rules, and messages you did not send. A blank Sent folder does not prove the account is secure, and one email header is not a complete verdict. Unknown successful sign-ins, newly added recovery methods, or forwarding rules you did not create justify account recovery even if the threat itself is a bluff. For a Microsoft mailbox, use the compromised Microsoft account recovery steps.
Choose the Response That Matches the Evidence
| Only the threatening email, possibly showing your own address | Do not pay, reply, open attachments, or follow links. Report it as phishing or spam. The message alone is not a Pegasus diagnosis. |
| An old password you recognize | Replace it wherever it is still used and enable multifactor authentication. Previously exposed data can make a bulk threat personal; the password is not evidence of a current camera recording. |
| Unknown sign-ins, sent messages, forwarding, or changed recovery details | Start the provider’s account-recovery flow independently. Revoke unknown sessions and secure the account from a trusted device. |
| A file, app, extension, or profile from the message was installed | Stop using that device for sensitive sign-ins, record what ran, and investigate the installation. A Windows malware scan is appropriate for an executed Windows file; it cannot certify an iPhone free of Pegasus. |
Why scammers mention Pegasus
Pegasus is a real high-end spyware name, so it sounds frightening. But real targeted spyware cases are not proved by a random email demanding crypto. Scam messages use vague claims, fake technical wording, and deadlines instead of verifiable evidence.
What If You Receive a Real Apple Threat Notification?
A genuine targeted-spyware alert is a different situation from a Bitcoin extortion email. Apple says you can verify its threat notification by independently signing in at account.apple.com and checking for the notification banner. Such notifications do not ask you to open email links or files, install a profile, or provide a password or verification code.[2]
If you confirm an Apple notification or have credible targeted-attack evidence, follow Apple’s guidance and seek specialist assistance. The Pegasus spyware guide covers that separate risk; do not rely on an ordinary desktop scan or pay the email sender as a test.
What to do after receiving the email
- Do not send Bitcoin or reply.
- Change passwords that appeared in the email or were reused.
- Enable multi-factor authentication on email and financial accounts.
- If you only downloaded a file, leave it unopened. Investigate and scan the affected device if an attachment, installer, command, or app actually ran.
- Report the message as phishing/extortion to your email provider and local authority if needed.
FAQ
Does the email prove my webcam was hacked?
No. These emails usually use fear and old leaked passwords, not real video evidence.
Why did it know my password?
Old breach data is often reused in extortion emails. Change reused passwords immediately.
Should I wipe my phone?
Usually no for a simple email. Focus on account security unless you installed a suspicious profile/app.
References
- Google. “Someone is sending emails from a spoofed address.” Gmail Help, accessed October 20, 2026. How sender-address spoofing works.
- Apple. “About Apple threat notifications and protecting against mercenary spyware.” Apple Support, August 13, 2026, accessed October 20, 2026. Verify a genuine Apple threat notification.
Absolutely agree! Pegasus is typically used to target high-profile individuals, and unlike regular spyware, it doesn’t require you to click any link to become infected. It’s also extremely expensive and not your average spyware.
Thank you so much for your detailed and thoughtful review!