According to one cybersecurity firm’s protection ecosystem data, attackers have been adding personally identifiable information to their approach emails

Based on data from its protection ecosystem, a cybersecurity firm has noticed a recent trend: cyber attackers have been increasingly using personal data (names, addresses, and photos of each victims’ residence) to personalize sextortion attacks and increase the pressure on them to pay up.

The sums involved have also increased: from the previous average of a few hundred US dollars to US$2,000.

Another trend is that sextortion operators have been incorporating QR codes to help victims pay more easily.

Sextortion trends in detail

Sextortion scams are a type of extortion where criminals attempt to extort money from victims by threatening to release explicit images or videos unless demands are met. Leveraging usernames and passwords stolen in data breaches, criminals contact victims and claim to have compromising content, allegedly from the victim’s computer, and threaten to publicly share it if victims don’t pay up.

Roughly 3% of phishing attacks in the firm’s annual metrics constitute sextortion. However, the latest approach emails have been addressing each victim by their first and last name, with the opening sentences of the email including the victim’s telephone number, street address, and city. Google Maps images of the victim’s home or work address have also been used in some cases.

Being a source of embarrassment, such sextortion attacks deter many victims from reporting the incident. Now, with the personal data added to the approach emails, victims have been less likely to avoid paying the higher ransoms.

According to Kyle Blanker, Manager, Software Engineering, Barracuda, the firm that reported their internal research: “Sextortion emails are usually sent to thousands of people at a time, as part of larger spam campaigns…  to avoid being caught by security tools and filters and increase the chances of success, attackers vary and personalize their messages to appear convincing and terrify the victim into paying.”

To control sextortion risks, individuals and organizations are advised to install email/phishing protection, including account-takeover protection; ensure proactive and strong security awareness, and remain vigilant against malware infection and social engineering risks.