aviatrix logoAviatrix
Under Active Attack

Executive Summary

Between December 2024 and June 2025, Ohio resident James Strahler II conducted an extensive AI-powered sextortion campaign targeting multiple women through cyberstalking, harassment, and the creation of non-consensual deepfake pornography. Using over 100 AI web-based models across 24 platforms, Strahler generated more than 700 sexually explicit images and videos of his victims, which he distributed to their workplaces and posted on child exploitation websites. His tactics included threatening victims and their families with public humiliation unless they provided additional explicit content, making rape threats referencing home addresses, and demanding compliance from victims' mothers. The case resulted in a 15-year federal prison sentence and marked the first conviction under the newly enacted Take It Down Act of 2025.

This incident highlights the emerging threat landscape where readily accessible AI tools are being weaponized for sophisticated harassment campaigns, demonstrating how threat actors are adapting generative AI capabilities for malicious purposes at an unprecedented scale and sophistication level.

Why This Matters Now

The proliferation of accessible AI deepfake tools has created a new category of cyber threats where attackers can generate convincing non-consensual content at scale, requiring updated security frameworks to address AI-powered harassment and extortion campaigns.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

James Strahler was the first defendant convicted under the Take It Down Act of 2025, which prohibits online publication of explicit content and AI forgeries without consent.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have reduced the attacker's ability to expand across multiple AI platforms and cloud services through segmented access controls. The blast radius of this cyberstalking campaign would likely have been constrained by limiting lateral movement between platforms and controlling egress paths for content distribution.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Identity-aware access controls would likely have limited the attacker's ability to leverage compromised credentials across multiple cloud platforms and services without proper verification

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Workload isolation policies would likely have reduced the attacker's ability to escalate from initial access to broader account privileges across integrated social media and cloud storage services

Lateral Movement

Control: East-West Traffic Security

Mitigation: Traffic inspection and policy enforcement would likely have limited the attacker's ability to move seamlessly between AI generation platforms and social media services without triggering security controls

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized visibility into communication patterns would likely have reduced the attacker's ability to maintain persistent, coordinated harassment campaigns across multiple cloud-based communication platforms

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Outbound traffic controls would likely have limited the attacker's ability to systematically transfer large volumes of generated content to external websites and distribution platforms

Impact (Mitigations)

While psychological harm to victims would still have occurred, the reduced scale of content generation and distribution would likely have limited the breadth of reputational damage and victim exposure

Impact at a Glance

Affected Business Functions

  • Personal Privacy Protection
  • Digital Identity Security
  • Online Safety
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Personal intimate images of at least 6 adult female victims were compromised, with over 700 AI-generated explicit images created and distributed. Real and AI-generated nude images were shared with victims' co-workers and posted on websites. Personal information including home addresses was obtained and used in threats.

Recommended Actions

  • • Implement Egress Security & Policy Enforcement to detect and block unauthorized uploads to AI platforms and suspicious websites that could be used for generating harmful content
  • • Deploy Zero Trust Segmentation with identity-based policies to limit access to personal data repositories and prevent lateral movement across cloud services and social media platforms
  • • Establish Multicloud Visibility & Control to monitor anomalous interactions with AI services, repeated API calls to content generation platforms, and suspicious automation patterns
  • • Activate Threat Detection & Anomaly Response capabilities to baseline normal user behavior and alert on covert tool usage, unauthorized access patterns, and bulk content generation activities
  • • Enforce Encrypted Traffic protection with data loss prevention controls to prevent exfiltration of personal images and sensitive data that could be used for AI manipulation and extortion

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image