FBI: Criminals Are Hacking Accounts to Steal Intimate Images
Federal investigators are warning of a surge in account-takeover schemes aimed at stealing intimate images and videos—and in some cases, brazenly promoting that content from victims’ own profiles. The playbook pairs hijacked accounts with extortion and persistent harassment, a combination that has led to severe psychological harm for some targets.
A new entry point: break in first, demand later
Unlike earlier sextortion waves that began with a request for images, the latest attacks start with silent access. Criminals compromise social media, cloud, and messaging accounts to find private media already stored there. Both adults and minors are being hit, with student-athletes and other public-facing young people drawing special attention because their bios, rosters, and fan followings make research—and later humiliation—easier. Young boys are notably impacted, though the threat extends across age groups and demographics.
How the intrusions happen
- Credential stuffing plus personal clues: Attackers test passwords leaked from past data breaches, then boost success rates by mixing in easily discovered details like birthdays, team names, or hometowns scraped from public profiles.
- Fake support texts harvesting verification codes: Targets receive messages that impersonate platform support, pressuring them to share login or two-factor codes under the guise of account recovery.
- Phishing sites that look official: Emails or DMs route victims to convincing but fraudulent support pages, where entering credentials or clicking links hands control to the attacker.
What happens after the takeover
Once inside, intruders sift accounts for intimate media and exfiltrate it alongside personal data. That bundle—images, handles, emails, phone numbers—gets traded or sold on criminal marketplaces, fueling repeated cycles of abuse. Victims report renewed extortion attempts, stalking, and swarm harassment as multiple bad actors recycle the same cache. Some offenders even weaponize the victim’s audience by posting or advertising the stolen content through the compromised account itself.
Part of a broader shift in cybercrime
The tactics mirror a wider trend toward stealthy account access that doesn’t rely on a victim typing a password in real time. Recent campaigns across the internet, from enterprise email break-ins to consumer social hijacks, show attackers chasing session tokens, multi-factor fatigue, and social engineering to quietly plant themselves inside accounts. The intimate-image theft wave differs in target and motive, but the core idea is the same: get in, stay in, then monetize.
Protect yourself: practical steps
- Keep intimate media offline: Avoid storing sensitive images or videos on internet-connected services, including cloud backups, DMs, and social accounts.
- Use unique, complex passwords: Never reuse credentials across sites. A reputable password manager can generate and store strong, distinct logins.
- Enable multi-factor authentication: Turn on MFA everywhere, preferably with an authenticator app or hardware key rather than SMS where possible.
- Skip the personal trivia: Don’t build passwords from names, birthdays, jersey numbers, or hometowns—anything an attacker can learn from your public footprint.
- Verify support the right way: Treat unsolicited “account help” messages as suspicious. Don’t share verification codes. If something seems off, navigate directly to the platform’s official help center or app settings on your own—never through links or phone numbers sent to you.
- Lock down recovery channels: Review connected email addresses, phone numbers, and trusted devices. Remove anything you don’t recognize.
If your account is compromised
- Regain control: Reset passwords, revoke active sessions, and enable MFA immediately. Check login history and remove unknown devices.
- Document everything: Note timelines, platforms affected, where any stolen content appears, and any messages demanding payment or threatening exposure.
- Report it: File a complaint with the FBI’s Internet Crime Complaint Center. If a minor is involved, notify appropriate child-safety authorities in your jurisdiction. Contact local law enforcement and use platform reporting tools to flag abuse and impersonation.
- Do not pay: Extortion rarely ends with a single payment. Prioritize account recovery, evidence collection, and official reports.
- Alert your circle: Inform friends, teammates, and followers that your account was compromised so they ignore any suspicious posts or messages.
Gaps and unknowns
The advisory did not include figures on victims, payouts, or the number of criminal groups behind these schemes. Underreporting is likely significant: shame and fear often keep targets from filing complaints, making the true scope hard to measure. Meanwhile, questions remain about the level of coordination between investigators and major social platforms on detection and takedown. For now, most guidance flows from authorities to the public, while the platform response has yet to be fully spelled out.
For creators, streamers, esports athletes, and anyone with a public following—especially teens—the message is stark: assume your social presence is an intelligence source for attackers. Harden your accounts, keep sensitive media offline, and verify every “support” prompt like your privacy depends on it—because it does.
