FBI warns of rising sextortion attacks targeting social media accounts
The US agency has issued an alert detailing how perpetrators brute-force passwords and impersonate support staff to extort victims or publish stolen content online.
The Federal Bureau of Investigation has issued a public alert warning that cybercriminals are increasingly targeting the social media accounts of adults and minors to steal intimate images and videos. The agency highlighted that perpetrators rely heavily on social engineering tactics to compromise accounts, with victims often facing extortion or having their stolen content published online.
According to the advisory, attackers employ methods such as brute-forcing passwords using leaked credentials, impersonating customer service representatives from platforms like Instagram, and sending phishing emails via fake domains that mimic legitimate login pages. The FBI noted that victims frequently experience re-victimisation through harassment, stalking, or targeted attacks where stolen content is advertised on the victim’s own social media pages.
While sextortion and the theft of intimate images are crimes that have existed for years, the issuance of this public alert suggests a potential escalation in activity. Rachel Tobac, chief executive of security awareness training firm SocialProof Security, told TechCrunch that these incidents may be on the rise. Tobac described the attacks as a significant public health issue, noting that they particularly target young boys and that some victims have been driven to self-harm in response to the abuse.
The FBI did not respond to requests for comment regarding the specific data or statistics underpinning the alert. Consequently, claims regarding a statistical rise in these incidents remain based on expert observation rather than official agency figures. The advisory emphasises that social media companies generally do not reach out to customers unprompted to recover accounts, a fact often exploited by fraudsters.
To mitigate risks, the FBI advises users to employ strong, unique passwords stored in a password manager and to enable multi-factor authentication. The agency also urges individuals to avoid storing sensitive or intimate material in online accounts and to remain suspicious of any unsolicited contact claiming to be from a social media platform’s support team.
