The FBI is warning that sexual exploitation actors are breaking into social media and personal accounts to steal sexually explicit images and videos, then posting or selling the material on criminal marketplaces.

In an Monday public service announcement, the FBI said the schemes target adults and minors and can expose victims to repeated harassment, sextortion, stalking and other attacks.

The stolen material, also known as nonconsensual intimate images, is often distributed alongside personally identifiable information, including victims’ names, dates of birth, email addresses, phone numbers and social media usernames, according to the FBI.

The agency said perpetrators use several methods to gain access to accounts.

In some cases, they make large numbers of password or PIN attempts using information collected from data leaks, social media and other publicly available sources. When targeting a specific person, those attempts may incorporate information such as the victim’s date of birth or variations of the person’s name.

Other schemes impersonate social media customer service representatives. Victims may receive a text message claiming their account will be disabled or locked unless they provide a verification code. The perpetrator then initiates a password reset, causing a legitimate code to be sent to the victim. If the victim shares it, the perpetrator can reset the password and take control of the account.

FBI Warns of Phishing Campaigns

The FBI also warned of phishing campaigns that use look-alike websites and email accounts designed to resemble social media customer support. Those messages may falsely warn users of new account logins and direct them to malicious links to change their passwords.

After gaining access, perpetrators can steal explicit images or videos without victims realizing their accounts have been compromised. The material may then be shared in online forums or sold through illicit marketplaces.

Victims can face further exploitation after the material is posted, the FBI said. In some cases, perpetrators advertise stolen content through a victim’s own social media account or use the material for harassment, sextortion, stalking or other targeted attacks.

The FBI recommends people avoid storing sensitive images or videos on social media platforms or other internet-accessible sites. Users should create unique, complex passphrases and PINs, enable multifactor authentication and avoid credentials based on names, birthdays, or other personal information.

People should also be cautious about links in emails and text messages and instead go directly to a service’s website or official app to address account problems. The FBI said users should never share temporary passwords, PIN reset codes or access codes they did not request, even when someone claims to represent a service they use.

Fraud, scams and other cyberthreats can continue to be reported to the FBI’s Internet Crime Complaint Center or a local FBI field office. The agency advises calling 911 for an immediate threat to life.

—

Connect with Anthony W. Haddad on social media. Got a tip? Send an email.