Sextortion with a twist: Spyware takes webcam pics of users watching porn

Sextortion has taken a technological twist with the open‑source infostealer Stealerium, which now automates spying on users browsing porn by screenshotting pages and triggering a webcam photo as they view NSFW content. According to wired[.]com, Proofpoint researchers analysed a variant of Stealerium that has been used in multiple campaigns since May this year, and which also gathers standard data such as banking details, usernames and passwords, and crypto wallet keys.

The malware is distributed as a free tool on GitHub, with its developer, who goes by witchfindertr and describes themselves as a London-based “malware analyst”, warning that the program is for “educational purposes only” and that users are responsible for how it is used. In the campaigns Proofpoint reviewed, victims were targeted with attachments or links, often via emails promising fake invoices or payments, and the stolen data is exfiltrated through channels including Telegram, Discord or SMTP.

Proofpoint notes that while no specific victims of the sextortion feature have been identified, the presence of the capability indicates it has likely been used.