Email is commonly used by threat actors for initial contact with victims and while most attacks attempt to steal credentials or distribute malware distribution, another type of scam has been steadily increasing. Sextortion scams have increased by 178% year over year according to data from ESET and are proving to be lucrative.
Email sextortion scams involve sending unsolicited emails threatening to expose the sexual activities of victims. The threat actor claims to have obtained compromising images or videos of a victim confirming that the individual is seeking sexual gratification or has been recorded engaging in sexual acts. The threat actor typically threatens to share the images and videos with the victim’s partner, family members, friends, social media contacts, and even their employer; however, the embarrassment and exposure can be avoided if the attacker’s demands are met. These scams have proven to be lucrative for threat actors, with many individuals paying to have the non-existent videos and images deleted. The amount charged by threat actors varies but is often in the region of $500 to $1,000.
One of the recently identified scams impersonates the adult website YouPorn. The messages claim that a sexually explicit video has been uploaded to the site and payment is required to have the video removed. If payment is not made, the video will be published on the website in 7 days. The user is told that they do not need to take any action if they have approved the use of the video on the website, but says that if the upload was not approved, it can be removed free of charge; however, there is no free option. The individual must pay and sign up for privacy protection, with the options offered costing from $199 to $1,399.
Scammers have also diversified from the standard sextortion scams and are conducting a range of scams using similar tactics. These include the impersonation of law enforcement agencies that claim illegal activity has been detected and payment is required to bring an investigation to a close, or pending legal action that can be avoided if payment is made. Some scammers have claimed to be hitmen and say the contract can be canceled if payment is made.
These scams can cause considerable stress and fear and many victims pay up due to the fear of the consequences should the threats be real. The best thing to do if you receive one of these emails is to simply delete it and not engage with the scammer as these are empty threats. There are no videos or images.
A worrying new type of sextortion scam is gaining traction where the threats issued are real and the consequences can be devastating for victims. Individuals are targeted and extorted with threats issued to publish explicit material that has been created using deepfake technology, where the victim’s face has been added to legitimate pornographic content. The images used for these scams are often obtained from social media profiles, and according to a recent warning from the Federal Bureau of Investigation (FBI), are also obtained by scammers who convince people to send them sexually explicit photographs. While these types of sextortion scams are much less common there are fears that they could increase as deepfake technology becomes more accessible and affordable. Once this material has been uploaded to online sites it can be very difficult for it to be removed. If you are targeted with one of these scams it is vital that you report it to law enforcement.
