TLDR
Attacker scrapes victim's public photos (LinkedIn / Instagram), face swaps them onto pornographic clip, then emails the victim demanding crypto payment or the clip will be sent to family/employer. Tells: 1) clip is sent as preview...
How it works
Attacker scrapes victim's public photos (LinkedIn / Instagram), face swaps them onto pornographic clip, then emails the victim demanding crypto payment or the clip will be sent to family/employer. Tells: 1) clip is sent as preview...
Red flags
- Urgent pressure to click, pay, or share codes immediately.
- A link or sender that does not match the official organization.
- Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What to do
- 1DO: do NOT pay (payment confirms the address is active and you'll be retargeted); save evidence; report to NCMEC (if minor depicted) + FBI IC3 + local police.
Source
Google-Threat-Analysis-Group
Source reviewed by Mythos Forensic Team
https://blog.google/threat-analysis-group/FAQ
Is Sextortion with deepfake of victim's face on adult content a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What should I do first?
DO: do NOT pay (payment confirms the address is active and you'll be retargeted); save evidence; report to NCMEC (if minor depicted) + FBI IC3 + local police.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.