Sextortion

Sextortion is a form of blackmail in which an attacker threatens to expose intimate, sexual, or otherwise compromising material about the victim unless they pay money, provide further material, or perform some action. In the enterprise context it matters for two reasons: employees targeted at home are coerced into decisions at work, and a large share of campaigns are pure bluff — mass-mailed extortion emails claiming to have webcam footage that never existed.

How it works

Sextortion campaigns fall into three broad patterns:

• Bluff extortion at scale. Mass emails claim the attacker has compromising recordings, often "proving" access by quoting a real password harvested from an old data breach. No footage exists; the leaked credential does the persuading. Payment is demanded in cryptocurrency.
• Relationship-based sextortion. The attacker builds rapport on dating apps or social media — a close cousin of the romance scam — solicits genuine intimate material, then flips to blackmail. Organized crews run this playbook at industrial volume.
• AI-assisted sextortion. Generative tools can now fabricate explicit imagery from ordinary public photos, meaning victims can be extorted with material that was never real — a threat the FBI has warned about explicitly.

The coercion can also aim beyond money. Intelligence services and criminal groups have historically used compromising material as leverage — the classic honey trap — to pressure employees into leaking data or granting access, which turns a personal crisis into an organizational insider threat.

How to defend against it

• Tell employees the bluff exists. Someone who knows the "we recorded you" email is a template with a recycled password is far less likely to panic or pay.
• Create a shame-free reporting path. Sextortion works because victims stay silent. Make clear that reporting — to security, HR, or law enforcement — will be met with support, not judgment.
• Advise against paying. Payment rarely ends the demands; preserving evidence and reporting to the FBI's IC3 or local authorities is the recommended response.
• Fold it into awareness. Extortion pressure is a human-layer risk like any other; a program built on human risk management principles should cover coercion, not just deception.