Romance-Scam Sexual Impersonation
This detects someone instructing an AI agent to pose as a young woman, offer sex or romantic interest to targeted men, and push them toward a Telegram link. It's a documented scam pattern where the attacker uses the agent to write persuasive, personalized messages instead of doing it by hand.
How the attack works
The attacker tells the agent to adopt a fake persona, usually a young woman, and gives it target information or instructions on who to contact. The agent is asked to generate flirtatious or sexual messages designed to build false intimacy quickly. The messages steer the target toward moving the conversation to Telegram via a specific link, which is typically where the scam continues (asking for money, images, or personal data). The rule flags this instruction pattern being given to the agent, not the scam's later stages.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d1af3f38-a5c2-485d-b7f4-6275f0864af3
- Severity
- High
Why it matters
An organization whose AI agent is used this way risks being a tool for fraud against third parties, reputational damage if traced back, and potential legal exposure for facilitating scam operations.
What you can do
- →Review agent logs for instructions asking the agent to impersonate a person or adopt a romantic/sexual persona toward named or targeted individuals.
- →Block or flag agent outputs that direct users to external messaging platforms like Telegram, especially paired with persona-based requests.
- →Restrict agent use cases that involve generating persuasive messages aimed at named third parties.
- →Distinguish legitimate uses, like anti-scam education content or genuine community invite links, from actual impersonation instructions before taking action.
Known benign look-alikes
- Legitimate Telegram community invite links
- Romance-scam awareness education