In 2008–2009, a box resembling an MSN Messenger notification appeared in the lower-right corner of many Turkish websites: “Ayça_22 is now on camera.” It was not a message but an advertisement. It sent those who clicked to webcam sites; according to user accounts, some of them ran into malware.
There is no reliable count of affected users.
“Ayça_22 is now on camera.” It seems to come from your own Messenger; it is actually an ad.
While browsing any site, a box styled as an MSN notification opens in the lower-right corner. The box says someone has turned on their camera and suggests it came from the user’s own Messenger. Clicking takes the user to a webcam or adult content site. According to user accounts, some redirects asked for a download named as a “camera plug-in” or “codec”; such files could carry malware.
The campaign was not exposed by a security vendor report but by users themselves. The notification appeared in the same corner with the same name on every site, even when Messenger was closed, which gave it away; dictionary threads served as warnings. Years later, a 2008 screenshot shared by a technology entrepreneur showed that older copies of the campaign existed.
There is no reliable count of affected users. The target was the broad audience consuming Turkish content and using MSN Messenger. Its lasting impact was less a data breach than how recognizable the fake-notification technique became in Turkey.
Today the same technique continues through browser notification permissions, fake CAPTCHA pages and “update required” windows. The difference: the click now often ends with an infostealer, and the passwords, cookies and sessions stored in the browser are put up for sale within minutes.
Monitor domains, phishing pages, ads and listings that impersonate your brand, and open takedown requests from the panel.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy