Yeah, this is way more likely than they were pranked by the friend.
Can he put some kind of hold on his bank account and credit cards until he can confirm that all’s well? What about geeks r us or whatever they call those guys? Best Buy used to have a good plan for a couple hundred a year.
I sure hope this has a good resolution for him, whatever it is.
update - all seems to be well. He has run a virus scan and come up clean. He has talked to the friend who sent the video, and it appears the friend was hacked; the friend did not send the email that started all this. However, a while back his friend did send an identical email that was real. Whatever did this caused the friend’s email to be sent again, with the attachment that caused the panic.
I’m mystified as to why anyone would want to do such a thing, but at least everything appears to be okay.
To show that they can, I’ve been told.