Another wave of sextortion scams was observed in New Jersey in which threat actors target and steal funds from unsuspecting potential victims. They claim to have compromised the victim’s computer, gained access to accounts, recorded videos through the webcam, and accessed emails, chat messages, the microphone, and personal information. They threaten to release purported explicit content of the target to contacts or social media platforms if payment is not made. In most cases, users are advised to disregard these emails and refrain from sending funds. However, the threat may be credible if data was breached, the user indeed sent explicit content, or the threat actors threatened to physically harm the target or their loved ones. In the reports, the threat actors demanded payment, ranging from $150 to $6,000 via cryptocurrency such as Bitcoin, peer-to-peer (P2P) payment services, or gift cards.
The Federal Bureau of Investigation (FBI) issued a warning about threat actors targeting specific individuals of interest, including adults and minors, as well as content on their social media and personal accounts. The threat actors attempt to gain unauthorized access to these accounts through social engineering tactics, such as phishing, social media customer service impersonations, and password and PIN targeting. If accessed, the threat actors steal personally identifiable information and explicit content to then post for sale on criminal marketplaces, perpetuating further victimization through harassment, sextortion, stalking, and other attacks.
If you or someone you know is being physically threatened, contact your local police department or dial 9-1-1 immediately.
Recommendations
- Reduce your digital footprint so threat actors cannot easily target you.
- Protect accounts and data by enabling multi-factor authentication (MFA) and keeping systems and browsers up to date.
- Review security and privacy settings for accounts, social media platforms, browsers, and devices, including cameras and microphones.
- Refrain from responding to unsolicited communications from unknown or untrusted senders. Exercise caution with communications from known senders.
- Refrain from sending explicit content of yourself to an unknown party. If you already have, do not send funds and immediately block them from all communications or platforms.
- If sensitive information was divulged or compromised, review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources.
- Search for and report malicious cryptocurrency addresses in the scam email to Chainabuse.
- Financial institutions are advised to review the FinCEN notice to identify and report suspicious activity related to financially motivated sextortion schemes.