Deepfake intimate images used for extortion after malware steals data
A university student in China had personal data stolen after clicking a malicious survey link, and attackers used image processing technology to create deepfake intimate photos from the student's legitimate selfies, then attempted extortion. The student reported the incident to police, who confirmed the attack involved trojan malware and noted similar cases targeting students.
What happened
A university student identified as Xiaoxiao received a survey questionnaire link from an acquaintance met in an online game. The link required entering an exclusive invitation code provided by the sender. After clicking the link and entering the code, malware was installed on the student's phone.
The attacker used screen-sharing to steal photos from the student's phone gallery and contact information. Using image processing technology, the attacker created multiple deepfake intimate images based on legitimate selfies from the phone's camera roll, then threatened the student with extortion, demanding money transfer and threatening to send the fabricated images to all contacts in the stolen address book.
Reported impact
The student reported feeling frightened and traumatized by the incident, describing the experience as 'shocking and thrilling.' The student recovered by deleting the malicious link, clearing background programs, and reporting to police.
Index analysis
A police officer who had handled similar cases explained that the malware was activated when the student clicked the link and entered the invitation code, allowing screen-sharing access to steal contact lists and photos. Police noted that attackers typically modify photos and send them via SMS to demand money.
Police identified this as a common scam targeting students using trojan links sent through app exploits, WiFi phishing hotspots, and fake base stations to trick victims into clicking. A similar case involved another victim named Liu who was extorted for 50,000 yuan after clicking a malicious link and subsequently complying with repeated demands through screen-sharing of a financial app.
Governance controls
Police advised the student to remain calm, delete the malicious link, clear background programs, and report to authorities. The student followed this guidance and also warned friends about the fraud through messages. Police recommended that citizens never click unknown links or scan unfamiliar QR codes, and if a phone becomes unresponsive or is detected as compromised, immediately remove the SIM card, disable WiFi and data, force shutdown, and call emergency services.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.