Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand - ATR-2026-01753 (73a3d47a-28c7-5023-b6eb-e432ac019954)
Detects ransom-extortion prompt injection attacks that instruct an agent to (1) forward email or file contents to an attacker-controlled address, (2) delete the sent/forwarded items to destroy evidence, and (3) send the victim a ransom note with payment instructions (wire transfer / IBAN / cryptocurrency). The invariant artifact chain is: external-email-forward + delete-sent-items + ransom-note-send with financial-transfer demand. Derived from AgentDojo indirect-pi-ransom-extortion corpus (2026-06, N=2). High-severity: successful execution causes data loss, privacy breach, and financial extortion.