Cyberpediaby Brain
ENDEFR

Webcam blackmail and sextortion

Intimidating message, quoted password, threat to publish: what the sources say about phishing and social engineering, and the reflexes.

In 30 seconds

Where it happens
By email, instant message or social network, channels that the sources cite for information phishing1.
What the attacker wants
To obtain information, often credentials, by playing on urgency1.
The reflex
Reply to nothing, keep the message, then report it and file a complaint if personal data is used to impersonate you or in case of fraudulent debits5.
If it has already happened
Change the affected password without delay, on every service where it is used, and have the bank block the card if payment details were given or fraudulent debits noticed45.

What it is

This article covers webcam blackmail and sextortion: an intimidating message that threatens to publish intimate images. This description is a framing of the article, not a fact taken from a source. An employee can receive it on a personal mailbox as well as a work one.

A note on the sources. The sources cited here contain no page devoted to sextortion itself: no dated campaign, no official alert on the subject, no figure. It does describe phishing and social engineering techniques. The link to sextortion is the article author's own: none of the sources cited here establishes it. This article is limited to what those pages establish.

Straight answers

Does a message that quotes my password prove I was hacked?

The sources cited here do not address this specific case. They do indicate, however, that information about victims can be exposed to attackers through datasets accessible online2. The Scattered Spider group, for example, used information from earlier data leaks to find employee names for social engineering2.

What is a message that sends repeated reminders looking for?

MITRE describes information phishing as an attempt to get the target to disclose information, often credentials. It frequently involves sending several messages that look urgent1. Urgency takes away the time the victim would need to check.

Is the displayed sender reliable?

No. Spoofing the sending address can fool the recipient and also automated security tools1. CISA adds that an address can imitate that of a known company by changing or omitting a few characters4.

Should I report it, even if I did not give in?

Yes. The UK's NCSC explains that reporting an attempt reduces the volume of messages received, makes the victim harder to target and protects other people3. In France, Cybermalveillance.gouv.fr says to report suspicious emails to Signal Spam and text messages to 337005.

What should I keep as evidence?

The message received, in particular. Cybermalveillance.gouv.fr recommends keeping the evidence, and passing on as much of it as possible when reporting5.

1Inside the attacker's head1 min

The sources first describe a preparation phase. MITRE classes the collection of information about victims' identity (names, email addresses, credentials, answers to security questions) as reconnaissance, before any attack2. This information can come from directly soliciting the victim, but also from online data or social networks2. The NCSC says it for the general public: criminals exploit information available online, including on social networks, to make their messages more convincing3.

Next comes the pretext. Information phishing often consists of posing as a source that would have a reason to ask for information1. The attacker can also try to obtain information through a direct exchange of emails or instant messages1. CISA describes a similar logic for social engineering: if a first source does not give enough, the attacker approaches another one in the same organization and relies on the first to seem credible4.

The sources cited here document neither the course of a trust-building exchange of images nor the payment demand. These elements are therefore absent from this article.

2What you see on screen1 min

The pages consulted give general signs of a fraudulent message, which serve here as checkpoints:

  • a sender address that imitates that of a legitimate company4;
  • a generic greeting and no contact details in the signature4;
  • links whose real address, visible on hover, does not match the displayed text4;
  • grammar, spelling or layout mistakes4;
  • an unsolicited attachment, sometimes accompanied by a false sense of urgency to get it opened without examination4;
  • a website address that differs by only one character from the expected address5.

A message can also invite the reader to call a number, where the attacker tries to collect confidential information1. A well-written, personalized message does not necessarily carry these flaws. Cybermalveillance.gouv.fr notes that attempts are now better and better made, but often show warning signs5.

3Under the hoodIT teams1 min

MITRE files information phishing (T1598) under the reconnaissance tactic. Its difference from classic phishing lies in the objective: collecting data from the victim, not getting them to run malicious code1. It can be targeted, against a person, a company or a sector, or mass-scale1.

Four variants are listed: by service, by attachment, by link and by voice1. The email can be spoofed, and attackers can also delete or modify emails and headers of compromised accounts to evade detection1.

On the defense side, MITRE cites the SPF and DKIM mechanisms, which policies such as DMARC allow an organization to enable, to filter messages according to the validity of the sender domain and the integrity of the message1. User training is cited as a measure1. For the collection of identity information, MITRE notes that it escapes the company's preventive controls and that the quantity and sensitivity of data accessible to third parties must be reduced2. The NCSC draws an employee-level tip from this: think about the personal information published and review the privacy settings of one's social network accounts3.

4What you do1 min

The actions the sources recommend:

  • Do not share sensitive information by message or by phone5.
  • Keep the message received as evidence5.
  • Change any disclosed password immediately, as well as that of the other services where it is used45.
  • Use a different password for each service and turn on two-factor authentication when the site allows it5.
  • If you gave payment details or noticed fraudulent debits, have the bank block the card5.
  • If personal data is used to impersonate you, file a complaint at the police station or gendarmerie, or write to the public prosecutor5.
  • Report the message to Signal Spam, or the text message to 337005.
  • For support, France Victimes answers on 116 006, free of charge, every day from 9 a.m. to 7 p.m.5.
  • In a professional setting, report the disclosure of the organization's information to the appropriate people, network administrators included4.
5Case filesReal cases1 min

None of the sources cited here documents a dated sextortion campaign: neither the waves of fake webcam-hacking emails, nor an official alert on this subject. No case file is therefore written here. It will be added when a source provides one.

The pages consulted give only neighboring examples, with no event date. Scattered Spider combined credential phishing and social engineering to capture one-time codes1. LAPSUS$ gathered detailed information about employees to strengthen its social engineering lures2.

Fact sheet

Identifier
CP-033
Wing
1. Attacks and techniques
Brain skill
Outsmarting Social Engineering (outsmart_social_engineering)
Brain reflex
cr-066
Diagram
G5 · Employee Decision Tree
Languages
de, en, fr
Sources
5 sources checked on 3 November 2026
Sources5 sources
  1. MITRE ATT&CK, “Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Gather Victim Identity Information, Technique T1589 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1589/ (accessed 3 November 2026)
  3. NCSC (UK), “Phishing scams: how to spot and report them”, 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026)
  4. CISA, “Avoiding Social Engineering and Phishing Attacks | CISA”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
  5. Cybermalveillance.gouv.fr, “Que faire en cas de phishing ou hameçonnage ?”, 10 January 2020. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing (accessed 3 November 2026)

Cite this article

Brain, “Webcam blackmail and sextortion”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/webcam-blackmail-sextortion/

BibTeX 
@misc{brain_cp033_en_2026,
  author = {Brain},
  title = {Webcam blackmail and sextortion},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/webcam-blackmail-sextortion/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence