FBI Warns of Social Account Takeovers Targeting Intimate Images
FBI flags account takeovers and image theft
The FBI has warned that cybercriminals are compromising the social-media accounts of adults and children to obtain intimate explicit images and videos. The agency said stolen material is often used to extort victims or is published online.
The alert describes a pattern in which account compromise becomes the start of further abuse. Victims may be re-victimised through harassment, sextortion, stalking and other targeted attacks, including advertisements for stolen content posted on a victim’s own social-media page.
How the attackers seek access
The FBI said perpetrators rely largely on social-engineering tactics. Their methods include brute-forcing accounts with leaked or previously used passwords, impersonating customer-service representatives, and contacting targets with claims that account recovery is required.
Some campaigns use phishing emails sent from deceptive domains designed to resemble legitimate social-media login pages. The aim is to persuade a target to enter credentials into a fraudulent page or otherwise surrender access to an account.
Instagram and other social-media companies are among the brands attackers may impersonate. Rachel Tobac, chief executive of security-awareness training firm SocialProof Security, said the attacks especially target young boys and described the issue as a significant public-health concern because some victims may be driven to self-harm.
Account security measures for organisations and users
The FBI recommends unique passwords stored in a password manager, with multi-factor authentication enabled. It also advises people to be suspicious of unsolicited contacts claiming to represent a social-media company, noting that technology companies generally do not contact customers in that way.
The warning reinforces a fraud pattern in which social platforms have become a major channel for financial deception: Americans lost $2.1 billion to scams shows how Americans lost $2.1 billion to scams through social media, SMS and email. In this case, the immediate objective may be account access and intimate content rather than a direct payment, but the resulting extortion and harassment can be prolonged.
The advisory further urges people not to store sensitive or intimate images in online accounts. For businesses, the practical implication is to make password-manager use, multi-factor authentication and phishing verification routine security practices, while ensuring staff know how to report suspected account compromise quickly.