Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand
An attacker hides instructions inside content an AI agent processes — like an email or document — telling it to secretly forward sensitive data elsewhere, delete the trace, and then send the victim a ransom note demanding payment. This turns a helpful email or file-handling agent into a tool for extortion, without the victim ever seeing an attacker directly.
How the attack works
An attacker plants hidden instructions in a message, document, or webpage that the AI agent will read as part of its normal task. When the agent processes that content, the injected instructions tell it to forward the victim's email or file contents to an external address controlled by the attacker. The agent is then instructed to delete the sent or forwarded items to hide what happened. Finally, the agent sends the victim a message demanding payment — via wire transfer, IBAN, or cryptocurrency — to get the stolen or 'held' data back.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- ad3eee1b-44ff-4827-ab90-f15dc403c8fd
- Severity
- Critical
Why it matters
A successful attack causes real data loss, exposes private or sensitive information to an outside party, and pressures the victim into making a financial payment under extortion.
What you can do
- →Restrict agents that handle email or files from independently forwarding content to new or external recipients without human approval.
- →Require explicit confirmation before an agent deletes sent, forwarded, or received items, especially right after a forwarding action.
- →Treat any agent-generated message containing payment instructions (wire transfer, IBAN, crypto wallet) as high-risk and route it for human review before sending.
- →Log and review sequences where an agent forwards data externally and then deletes related records shortly after — this pairing is a strong warning sign even outside this specific scenario.
Known benign look-alikes
- Legitimate email-forwarding agent tasks that happen to mention delete-after-forward
- Financial operations agents that process IBAN numbers in normal transaction flows
- Security training simulations that reproduce this attack pattern in documentation