FBI: Sextortion Hackers Steal Photos via Fake Support

The FBI warns that criminals are breaking into social media and personal accounts to steal explicit images and sell them online, often bundled with personal details. The advisory describes common social-engineering lures, like fake customer-service texts and phishing emails, that trick people into sharing password reset codes or clicking malicious links, leading to account takeover and potential sextortion.

Key findings

• FBI warns criminals are stealing explicit images by hacking social media and personal accounts, then selling them on the dark web with identifying details.
• The advisory highlights three access methods: password/PIN attacks using leaked data, customer-service impersonation via text to steal reset codes, and phishing emails with fake support domains and malicious password-reset links.
• Stolen images and personal details can be used for sextortion, re-victimizing targets through blackmail.

Who’s being targeted

• Commonly targeted roles: All employees, Executives, HR, Finance, Customer-facing teams, Anyone with company-linked social media accounts.
• Affected industries: Consumers/individual account holders, Social media platforms, Online services with user accounts.
• Attack channels: smishing, email, website.
• Impersonated: Social media company customer service, Social media company customer service support.

Awareness takeaways

• Never share password reset codes or temporary access codes, treat them like your password.
• Avoid clicking links in unexpected messages; go directly to the official site/app to sign in or change your password.
• Use unique, complex passwords/PINs and enable multi-factor authentication where available.
• Reduce risk by not storing sensitive/explicit images on social media or public internet sites.

Red flags to watch for

• Unsolicited text claiming your account will be disabled/locked
• You receive a reset code you did not request
• Request to share a one-time code (legitimate support will not ask)
• Email comes from a lookalike domain impersonating support
• Unexpected 'new login' alert urging immediate action
• Embedded link to change password instead of using the official app/site