This is the first time it's happened to me and I was definitely gullible. But I'd like to ask for advice, and sorry if it's a long post.
So, I was on Discord as usual and someone on my friends list messaged me. I haven't talked to this person in over 4 years, but I do remember them, so I let my guard down when they asked if I could try out their game project and give them feedback, which would only take around 5-10 minutes.
Since I thought I was helping an old friend, I opened the website and downloaded the file. However, the moment I ran the exe file, my browsers closed and no "game" would appear, which alarmed me.
That's when the person impersonating my friend sent me screenshots of my Gmail accounts and said that they "hacked" me and that they have all my passwords and info, etc. All of which seemed like broken English when I look back at it, so I knew it couldn't have been the actual owner of that Discord account as they're fluent in English. But since it was the first time it happened to me, I was panicking a bit on what to do first (like do I call the police etc.?). They tried to blackmail me, saying things like: Pay $350 for passwords and $350 for photos, info, etc. Or both for $650. If not, I sell to deep web. (Isn't it the Darkweb?)
Anyways, they obviously tried to pressure me into paying at this point, but I told them I'm in debt and recently got fired from my job. They can even see the termination letter in my email. That's when they stopped messaging me.
I've already logged out of all my emails and changed my passwords, making sure I have 2FA set up on all the important stuff. I also reported the Discord profile used to scam me, ran my computer through a malware scanner, and checked if anything recent had been installed on my computer. After calming down a bit, I thought it was strange that they only showed screenshots of my emails—even alternative ones I never really use—and a screenshot of my Discord that shows my email and phone number since it was a friend contact. There's no other "screenshots" of anything else "important," but I could be underestimating things. They tried to access one of my Google accounts but it was automatically locked out because it detected a login from Istanbul, which I am nowhere near.
I also thought it was weird that they had screenshots of my emails when I clearly didn't have those tabs open at that moment, even though I closed all my browsers and deleted history, cache, etc. Luckily, I never save passwords in browser password managers just in case. So my question is: What should I do next? Was there anything I can do better or did I miss any other steps? Are cases like these common?
I know about common email, text message, and so forth types of scams, which are easy to detect. But since this came from someone on my Discord friend list, I thought this might be something to worry about and spread awareness to those who never had this experience.