The Federal Bureau of Investigation has issued a public alert regarding a surge in social engineering and cyber intrusion tactics used by threat actors to compromise social media accounts. The attackers are reportedly targeting both adults and children to steal explicit content, which is then sold on illicit marketplaces. The FBI also noted that personal information is often posted alongside the stolen content.
According to the bureau's Monday notice, these cybercriminals employ various methods to gain unauthorized access. Some incidents involve brute-force attempts, where hackers repeatedly try passwords or PINs obtained from data leak sites. When targeting individuals known to them, attackers may use variations of the victim's birthdate or name as potential passwords.
Another common tactic involves impersonation. Threat actors contact victims under the guise of social media company representatives, falsely claiming that their accounts have been breached. They then inundate victims with text messages requesting password resets or containing codes that allow the attackers to reset the victim's password themselves.
The FBI also highlighted the use of cloned social media sites. These fake platforms are designed to mimic legitimate sites, and any login credentials entered by victims are directly transmitted to the cybercriminals.
The consequences for victims extend beyond the initial breach and theft. The FBI stated that after their content is posted or sold, victims often experience "re-victimization through harassment, sextortion, stalking or other targeted attacks," including the advertising of stolen content on their own social media pages.
This alert follows recent legal actions taken by the Department of Justice against individuals involved in similar schemes. In February, an Illinois man, 27, pleaded guilty to charges related to a campaign that compromised approximately 600 women's Snapchat accounts. Last year, a former University of Michigan assistant football coach was indicted for hacking into student athlete databases across more than 100 colleges and universities, accessing medical information for about 150,000 individuals. This data was then used to breach the social media accounts of female student athletes.
