Security researchers have detected a 178% increase in sextortion emails between the first half of 2022 and the same period this year, marking the category out as a top email threat.
ESET said that sextortion emails ranked third among all email threats in H1 2023. They typically arrive unsolicited and claim to have compromising images or videos on the victim, taken via their webcam, which will be shared with friends and contacts if a ransom is not paid.
“Today we are seeing a clear rise in emails that claim to have obtained personal, sexual material without the victim knowing. As you can imagine, receiving an email of this nature creates fear and anxiety that some of the victim’s more intimate or personal moments have been captured and risk being shared with friends and family as well as the public,” explained ESET global cyber security advisor, Jake Moore.
“The good news is that the scam is an empty threat that aims to play on the victim’s fears of receiving payment. By knowing this, they can then be confidently ignored.”
Read more on sextortion: UK Sextortion Cases Doubled in 2021
ESET traced one scam back to a single actor who apparently demands £1000 ($1260) in bitcoin for not sharing the non-existent webcam video they claim to have.
In fact, research by Barracuda Networks earlier this year claimed that extortion scams are the work of just a small group of threat actors.
That’s good news, because if law enforcement can disrupt them, it could have a significant impact on the volume of these threats hitting inboxes. It should also make it easier for security vendors to block the emails, as many of these actors are using similar techniques and templates in their scams.
However, sextortion can also refer to a more serious type of fraud, where malicious actors use deepfake technology to create explicit content featuring the victim’s face, which they then use to demand a ransom or real explicit photos.
The FBI recently issued an alert about the threat, warning that both children and adults have fallen victim and that it is “extremely difficult if not impossible” to have manipulated content removed once posted online.