In a nutshell: The FBI has issued a warning for anyone who likes to take explicit photos (i.e., nudes) of themselves. Hackers are targeting both adult and underage users by compromising their social media and personal accounts to steal these images and sell them on criminal marketplaces – and they often include details about the victims.
The FBI's warning concerns what it calls sexual exploitation actors. These criminals target specific people they are interested in, who may be strangers or known to them, as well as opportunistic victims. Once inside an account, they search for sexually explicit photos and videos, steal them without the owner's knowledge, and share them in community forums or sell them through illicit marketplaces.
Making an already nightmarish situation worse, the stolen content is often accompanied by personally identifiable information such as the victim's name, date of birth, email address, phone number, and social media username. This can lead to repeated victimization through harassment, stalking, sextortion, and other targeted attacks. Some criminals even advertise the stolen material through the victim's own social media account.
The FBI says attackers use several methods to gain access. One involves repeatedly trying passwords and PINs based on lists compiled from data breaches, social media, and other public sources. If the target is known, criminals may use birthdays, names, and variations of personal details.
Another method starts with a text claiming the recipient's social media account will be locked or disabled unless they supply a verification code. The attacker simultaneously requests a genuine password reset, causing the platform to send the victim a code. Handing it over allows the criminal to reset the password and take control.
There are also traditional phishing attacks involving emails from look-alike domains posing as social media support. These warn of a new login and include a malicious link for changing the password.
A recent example illustrates just how effective these tactics can be. Last month, an Illinois man received a 76-month prison sentence after sending fake Snapchat support texts to more than 1,500 women. At least 517 accounts were compromised, allowing him to download nude or semi-nude photos belonging to at least 59 victims, Reuters reported.
The most famous example, of course, remains 2014's Celebgate, aka The Fappening, when phishing attacks compromised hundreds of iCloud and Gmail accounts, leading to celebrities' private images appearing online.
The FBI recommends not storing sensitive images on internet-accessible services, using unique passphrases and PINs, enabling multi-factor authentication, and never sharing verification codes.