---
id: CP-033
slug: webcam-blackmail-sextortion
lang: en
title: Webcam blackmail and sextortion
description: "Intimidating message, quoted password, threat to publish: what the sources say about phishing and social engineering, and the reflexes."
canonical_url: https://startbrain.io/cyberpedia/en/articles/webcam-blackmail-sextortion/
markdown_url: https://startbrain.io/cyberpedia/en/articles/webcam-blackmail-sextortion.md
publisher: Brain (https://startbrain.io)
license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)
cite_as: Brain, "Webcam blackmail and sextortion", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/webcam-blackmail-sextortion/ (CC BY 4.0)
wing: 1
theme: outsmart_social_engineering
reflex: cr-066
schema: G5
updated: "2026-11-03"
translations:
  en: https://startbrain.io/cyberpedia/en/articles/webcam-blackmail-sextortion/
  fr: https://startbrain.io/cyberpedia/fr/articles/chantage-webcam-sextorsion/
  de: https://startbrain.io/cyberpedia/de/articles/webcam-erpressung-sextortion/
  es: https://startbrain.io/cyberpedia/es/articles/chantaje-webcam-sextorsion/
sources:
  - "n": 1
    title: Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®
    publisher: MITRE ATT&CK
    url: https://attack.mitre.org/techniques/T1598/
    accessed: "2026-11-03"
  - "n": 2
    title: Gather Victim Identity Information, Technique T1589 - Enterprise | MITRE ATT&CK®
    publisher: MITRE ATT&CK
    url: https://attack.mitre.org/techniques/T1589/
    accessed: "2026-11-03"
  - "n": 3
    title: "Phishing scams: how to spot and report them"
    publisher: NCSC (UK)
    url: https://www.ncsc.gov.uk/collection/phishing-scams
    published: "2021-11-26"
    accessed: "2026-11-03"
  - "n": 4
    title: Avoiding Social Engineering and Phishing Attacks | CISA
    publisher: CISA
    url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks
    published: "2021-02-01"
    accessed: "2026-11-03"
  - "n": 5
    title: Que faire en cas de phishing ou hameçonnage ?
    publisher: Cybermalveillance.gouv.fr
    url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing
    published: "2020-01-10"
    accessed: "2026-11-03"
---

# Webcam blackmail and sextortion

This article covers webcam blackmail and sextortion: an intimidating message that threatens to publish intimate images. This description is a framing of the article, not a fact taken from a source. An employee can receive it on a personal mailbox as well as a work one.

A note on the sources. The sources cited here contain no page devoted to sextortion itself: no dated campaign, no official alert on the subject, no figure. It does describe phishing and social engineering techniques. The link to sextortion is the article author's own: none of the sources cited here establishes it. This article is limited to what those pages establish.

## In 30 seconds

- Where it happens: by email, instant message or social network, channels that the sources cite for information phishing [1].
- What the attacker wants: to obtain information, often credentials, by playing on urgency [1].
- The reflex: reply to nothing, keep the message, then report it and file a complaint if personal data is used to impersonate you or in case of fraudulent debits [5].
- If it has already happened: change the affected password without delay, on every service where it is used, and have the bank block the card if payment details were given or fraudulent debits noticed [4][5].

## Straight answers

### Does a message that quotes my password prove I was hacked?

The sources cited here do not address this specific case. They do indicate, however, that information about victims can be exposed to attackers through datasets accessible online [2]. The Scattered Spider group, for example, used information from earlier data leaks to find employee names for social engineering [2].

### What is a message that sends repeated reminders looking for?

MITRE describes information phishing as an attempt to get the target to disclose information, often credentials. It frequently involves sending several messages that look urgent [1]. Urgency takes away the time the victim would need to check.

### Is the displayed sender reliable?

No. Spoofing the sending address can fool the recipient and also automated security tools [1]. CISA adds that an address can imitate that of a known company by changing or omitting a few characters [4].

### Should I report it, even if I did not give in?

Yes. The UK's NCSC explains that reporting an attempt reduces the volume of messages received, makes the victim harder to target and protects other people [3]. In France, Cybermalveillance.gouv.fr says to report suspicious emails to Signal Spam and text messages to 33700 [5].

### What should I keep as evidence?

The message received, in particular. Cybermalveillance.gouv.fr recommends keeping the evidence, and passing on as much of it as possible when reporting [5].

## Inside the attacker's head

The sources first describe a preparation phase. MITRE classes the collection of information about victims' identity (names, email addresses, credentials, answers to security questions) as reconnaissance, before any attack [2]. This information can come from directly soliciting the victim, but also from online data or social networks [2]. The NCSC says it for the general public: criminals exploit information available online, including on social networks, to make their messages more convincing [3].

Next comes the pretext. Information phishing often consists of posing as a source that would have a reason to ask for information [1]. The attacker can also try to obtain information through a direct exchange of emails or instant messages [1]. CISA describes a similar logic for social engineering: if a first source does not give enough, the attacker approaches another one in the same organization and relies on the first to seem credible [4].

The sources cited here document neither the course of a trust-building exchange of images nor the payment demand. These elements are therefore absent from this article.

## What you see on screen

The pages consulted give general signs of a fraudulent message, which serve here as checkpoints:

- a sender address that imitates that of a legitimate company [4];
- a generic greeting and no contact details in the signature [4];
- links whose real address, visible on hover, does not match the displayed text [4];
- grammar, spelling or layout mistakes [4];
- an unsolicited attachment, sometimes accompanied by a false sense of urgency to get it opened without examination [4];
- a website address that differs by only one character from the expected address [5].

A message can also invite the reader to call a number, where the attacker tries to collect confidential information [1]. A well-written, personalized message does not necessarily carry these flaws. Cybermalveillance.gouv.fr notes that attempts are now better and better made, but often show warning signs [5].

## Under the hood

MITRE files information phishing (T1598) under the reconnaissance tactic. Its difference from classic phishing lies in the objective: collecting data from the victim, not getting them to run malicious code [1]. It can be targeted, against a person, a company or a sector, or mass-scale [1].

Four variants are listed: by service, by attachment, by link and by voice [1]. The email can be spoofed, and attackers can also delete or modify emails and headers of compromised accounts to evade detection [1].

On the defense side, MITRE cites the SPF and DKIM mechanisms, which policies such as DMARC allow an organization to enable, to filter messages according to the validity of the sender domain and the integrity of the message [1]. User training is cited as a measure [1]. For the collection of identity information, MITRE notes that it escapes the company's preventive controls and that the quantity and sensitivity of data accessible to third parties must be reduced [2]. The NCSC draws an employee-level tip from this: think about the personal information published and review the privacy settings of one's social network accounts [3].

## What you do

The actions the sources recommend:

- Do not share sensitive information by message or by phone [5].
- Keep the message received as evidence [5].
- Change any disclosed password immediately, as well as that of the other services where it is used [4][5].
- Use a different password for each service and turn on two-factor authentication when the site allows it [5].
- If you gave payment details or noticed fraudulent debits, have the bank block the card [5].
- If personal data is used to impersonate you, file a complaint at the police station or gendarmerie, or write to the public prosecutor [5].
- Report the message to Signal Spam, or the text message to 33700 [5].
- For support, France Victimes answers on 116 006, free of charge, every day from 9 a.m. to 7 p.m. [5].
- In a professional setting, report the disclosure of the organization's information to the appropriate people, network administrators included [4].

## Case files

None of the sources cited here documents a dated sextortion campaign: neither the waves of fake webcam-hacking emails, nor an official alert on this subject. No case file is therefore written here. It will be added when a source provides one.

The pages consulted give only neighboring examples, with no event date. Scattered Spider combined credential phishing and social engineering to capture one-time codes [1]. LAPSUS$ gathered detailed information about employees to strengthen its social engineering lures [2].

## Sources

1. MITRE ATT&CK, "Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026)
2. MITRE ATT&CK, "Gather Victim Identity Information, Technique T1589 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1589/ (accessed 3 November 2026)
3. NCSC (UK), "Phishing scams: how to spot and report them", 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026)
4. CISA, "Avoiding Social Engineering and Phishing Attacks | CISA", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
5. Cybermalveillance.gouv.fr, "Que faire en cas de phishing ou hameçonnage ?", 10 January 2020. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing (accessed 3 November 2026)

---

Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/webcam-blackmail-sextortion/
You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.