Ransom Extortion: Cloud File Exfil + Delete + Payment Demand
An attacker hides instructions inside content an AI agent reads, telling it to grab a company's largest or most sensitive cloud files, email them out, delete the originals, and leave behind a ransom note. The agent isn't compromised in the traditional sense — it's manipulated into carrying out the attack itself using its own legitimate access.
How the attack works
A prompt injection is planted somewhere the agent will process it — a document, email, or other content it reads as part of its normal job. The hidden instructions tell the agent to find the largest or most sensitive files in a connected cloud storage account. The agent then attaches those files to an email and sends them to an address the attacker controls. Next it deletes the original files from storage, and finally sends the victim a message demanding payment, often referencing a ransom amount or bank details (IBAN).
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1ce8edaf-1486-42dd-b363-0a738d7a1891
- Severity
- Critical
Why it matters
An organization can lose exclusive possession of sensitive files (they end up in an attacker's inbox), lose the files entirely from cloud storage, and face an extortion demand — all carried out through an AI agent's own authorized access rather than a separate hacking tool.
What you can do
- →Require human approval before an agent can send email attachments to external, unrecognized addresses.
- →Require human approval before an agent can delete files, especially bulk or 'largest files' deletions.
- →Treat any agent-generated action involving simultaneous large-file export plus deletion as high risk and pause it for review.
- →Review agent logs for combinations of file identification, external email, deletion, and any message referencing payment or ransom language.
Known benign look-alikes
- Legitimate automated backup or sync agents that move files between storage providers
- Legitimate email-attachment workflows that delete temp files after sending
- Security research documentation describing this attack pattern