Purported AI-Generated Video Reportedly Used in RM5,800 (~$1,400) Sextortion Attempt Targeting Malaysian Minor via Telegram

A Malaysian family reported that scammers used purported AI-generated explicit video content to target their teenage son in a sextortion attempt. The perpetrators allegedly contacted the boy via Telegram, sending manipulated footage that depicted him in compromising situations and demanding RM5,800 (~$1,400) to prevent its release. The family alerted authorities and warned others about the growing use of generative AI in targeting minors.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves scammers using AI-generated explicit content to target and extort a specific minor for financial gain, which constitutes targeted fraud and manipulation.

Additional risk subdomains

• 1.2 Exposure to toxic content: The victim was directly exposed to toxic, sexually explicit synthetic content created to harass and extort him.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The extortion incident was caused by the intentional actions of human scammers utilizing deployed AI deepfake generation tools to target a minor.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3: The incident involves 'AI-generated content such as deepfakes', which falls under Limited Risk due to transparency obligations, though its malicious use by humans caused harm.

AI system and alleged parties

• AI system: AI deepfake tools
• AI purpose: Deepfake Video Generation; Deepfake Image Generation
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Unknown sextortionists, Unknown scammers, Unknown criminal actors operating on Telegram
• Alleged harmed parties: Unnamed Malaysian minor in sextortion attempt, General public of Malaysia, Family of unnamed Malaysian minor in sextortion attempt

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Substantial, indirect Negligible

Malicious content

Reported: The report explicitly describes the creation of an AI-generated explicit video used for extortion.

Directly caused: An AI-generated explicit 'hamsap' video of the teenage boy was created and sent directly to him via Telegram.

Privacy

Reported: The report explicitly describes the unauthorized use of the boy's personal photo to generate the deepfake.

Directly caused: The perpetrators obtained a personal photo of the teenage boy without authorization to create a synthetic explicit video.

Psychological

Reported: The report explicitly describes psychological distress and fear caused by the extortion attempt.

Directly caused: The teenage boy received a threatening message with an explicit deepfake video, causing him to feel frightened, while his mother experienced fear and distress upon learning of the threat.

Inferred additional harm: It is highly likely that the victim and his family suffered ongoing anxiety, stress, and trauma from the targeted sexual harassment and extortion attempt.

Child sexual exploitation and abuse

Reported: The report describes an AI-enabled sextortion incident targeting a minor using explicit synthetic content.

Directly caused: An AI-generated explicit video of a teenage boy was created and used to extort him.

People affected

• Occurrences reported: 1
• People reportedly harmed: 2
• People reportedly exposed: 2

Potential causes

Management

• Inadequate Platform Safety Policies: Platform management fails to prioritize safety measures against AI extortion.

Technology

• AI Deepfake Generation Tools: Scammers easily access AI tools to generate realistic explicit videos.
• Anonymous Messaging Platforms: Telegram allows accounts without visible phone numbers, shielding scammers.

Data Inputs

• Accessible Personal Photos: Publicly accessible photos were harvested to generate the deepfake.

Human Factors

• Targeting of Vulnerable Minors: Scammers exploit minors' fear to extort money.
• Oversharing on Social Media: Users upload personal photos online, providing raw material for deepfakes.

Process and Methods

• Inadequate Content Moderation: Messaging platforms lack real-time filtering for non-consensual deepfakes.

Regulatory Environment

• Lack of Deepfake Regulation: Insufficient legal frameworks to restrict the creation of malicious AI tools.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly outlines the sequence of events, the nature of the threat, the medium used (Telegram), the demand amount (RM5,800), and the involvement of AI deepfake tools. There is little ambiguity regarding the facts of this specific case.
• Ambiguities identified: The specific AI tool used to generate the deepfake is not named.

An AI-enabled sextortion incident in Malaysia where scammers used deepfake video generation to target and extort a minor. While representing an evolved capability in cyber-enabled crime and a minor threat to societal privacy protections, the incident has negligible direct national security implications.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Malaysia
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing, strategic public safety concern regarding the accessibility of deepfake tools rather than an active national security crisis.
• Autonomy: Human-controlled. The AI system was used strictly as a tool by human operators to generate specific content, with no autonomous decision-making.
• Novelty: Evolved capability. Represents an evolved capability of traditional financial extortion and harassment, enhanced by the accessibility of realistic AI video generation.

Impact by dimension

• Physical security: Negligible. No physical infrastructure, kinetic targeting, or human safety threats to critical systems were involved in this incident.
• Information security: Negligible. While utilizing deepfake technology, this was a localized financial extortion attempt targeting an individual rather than an information warfare campaign or intelligence breach.
• Sovereignty: Negligible. The incident was a criminal scam targeting a private citizen and did not impact government operations, elections, or state sovereignty.
• Economic security: Negligible. The financial impact was negligible, involving an unpaid individual extortion demand of RM5,800, with no threat to strategic industries or financial systems.
• Societal stability: Minor. The incident involved privacy violations and psychological harm to a minor through synthetic explicit content, representing a minor localized threat to public safety.