The Federal Bureau of Investigation (FBI) is warning the public about sexual exploitation (SE) actors targeting adult and underage victims by illegally accessing their social media and personal accounts to steal and post their explicit content (also known as non-consensual intimate images, or NCII) for sale on criminal marketplaces. SE actors are using a variety of social engineering and cyber intrusion tactics to target specific individuals of interest — who may or may not be known to the actor — or general targets of opportunity. Once the sexually explicit images or videos are accessed and stolen, typically unbeknownst to the victim, SE actors are sharing or posting the content within community forums or selling them to illicit marketplaces. Personally identifiable information — such as name, date of birth, email, phone number, and social media username — is often posted along with the victim’s explicit content, exposing them to continued re-victimization.
How Explicit Content is Accessed and Exposed
The FBI has observed SE actors using various tactics for illegal access to victim accounts, including:
- Password and PIN Targeting: SE actors use high volume password and PIN attempts on social media and personal accounts based on curated lists obtained from a variety of sources, such as data leak sites, social media, and open source. The lists include personal information, such as date of birth or name variations, when the victims are known to them.
- Social Media Customer Service Impersonations: SE actors send victims text messages stating their social media account is being disabled or locked unless they respond with a verification code. SE actors then request a password reset for the victim’s social media account, which generates a code and is sent to the victim. Once the victim shares the code, the SE actor can reset the victim’s password and access the account.
- Phishing: SE actors create look-alike domains and email accounts emulating social media customer support to notify victims about “new logins” into their account. The impersonated emails include a malicious embedded link to “change [their] password,” and once clicked, SE actors gain access to the account.
Once the sexually explicit content is stolen, SE actors post or sell it to criminal marketplaces, which often includes personal information about the victim and typically without their knowledge. As a result, victims often face re-victimization through harassment, sextortion, stalking or other targeted attacks, such as advertising stolen content on a victim’s own social media page.
The original announcement can be found here.
