"Once the sexually explicit content is stolen, SE actors post or sell it to criminal marketplaces, which often includes personal information about the victim and typically without their knowledge," the FBI warned.
How the FBI describes the threat
The FBI's public service announcement this week warns that cybercriminals are actively targeting adults' and children's social media and other online accounts to steal sexually explicit images or videos. According to the bureau, attackers who obtain that content may use it to blackmail victims, try to sell the material on criminal marketplaces, or share victims' personal information with other criminals to fuel further coercion.
Sextortion: methods, costs, and past enforcement
The bulletin defines sextortion as "a form of online blackmail in which cybercriminals threaten victims with publicly leaking nude images and videos they stole (through hacking) or obtained (through coercion)." The FBI notes that victims frequently face re-victimization through harassment, sextortion, stalking, or other targeted attacks — including having stolen content advertised on a victim's own social media page.
The agency pointed to prior waves of activity: it issued a large warning in September 2021 about a massive increase in sextortion complaints. The announcement also noted a recent criminal sentence: in May, a Canadian man was sentenced to 33 years in prison for targeting more than 145 children across the United States in an eight-year-long sextortion scheme.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildIndicators the FBI has identified
- Unsolicited text messages claiming an account will be disabled unless the recipient provides a verification code.
- Unsolicited emails that reference a new login and include an embedded link to reset a password.
The FBI emphasized that a legitimate platform or service will not request a verification code, temporary password, or PIN reset code from an account holder. The bureau also warned that once attackers are using valid credentials, prevention measures can fail: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply," the advisory notes.
NCAA and student-athletes: a coordinated warning
The FBI and the National Collegiate Athletic Association (NCAA) issued a joint warning the same day, saying student-athletes' online accounts are being targeted in similar sexual exploitation schemes. The agencies asked coaches, compliance staff, and athletic department leadership to raise awareness within schools and communities.
The advisory for athletic programs was practical and direct: tell potential victims not to reply to texts or emails asking for verification codes or to click password-reset links; advise against storing explicit photos or videos on social media accounts or other Internet-accessible sites; and encourage the use of complex passwords and multi-factor authentication whenever possible.
What this means for account holders, coaches, and athletic leaders
- Account holders (adults and children): Do not provide verification codes or temporary passwords to anyone who requests them via text or email, and avoid storing sexually explicit images on platforms that are accessible over the Internet.
- Coaches and compliance staff: Raise awareness among student-athletes about the specific indicators the FBI identified and the behavioral steps the bureau recommends — do not reply to verification-code requests, do not click unsolicited password reset links, and enable multi-factor authentication where possible.
- Athletic department leadership: Promote policies and training that discourage storing private explicit content on Internet-accessible services and that reinforce strong password hygiene across teams and support personnel.
The FBI did not disclose what specifically prompted this alert; the bulletin notes the bureau often issues public service announcements after noticing an increase in the incidents addressed. For those already targeted, the FBI's past guidance — reiterated here — is clear: stop interacting with extortionists and contact law enforcement.
Read the original advisory: https://www.bleepingcomputer.com/news/security/fbi-warns-of-hackers-targeting-online-accounts-to-steal-explicit-photos/
