FBI: Hackers using social engineering to breach accounts and steal explicit content

FBI: Hackers using social engineering to breach accounts and steal explicit content

Hackers are breaking into the social media accounts of both adults and children to steal explicit content and sell it on criminal marketplaces, according to a new FBI alert released this week.

In a notice on Monday, the bureau said threat actors are “using a variety of social engineering and cyber intrusion tactics to target specific individuals of interest — who may or may not be known to the actor — or general targets of opportunity.”

The FBI added that the hackers are also posting personal information alongside the explicit content.

Some cybercriminals break into accounts by repeatedly trying different passwords or PINs found on data leak sites and other sources. When victims are people they know, the hackers use different variations of their birthday or name.

In other cases seen by FBI agents, hackers have contacted victims pretending to be social media company representatives claiming their accounts have been breached. They bombard victims with texts requesting password resets or with codes that allow the threat actors to reset the victim’s password themselves.

The notice adds that some incidents involved cloned social media sites made to look like legitimate platforms. When login information is entered on the fake sites, it is sent to the cybercriminals.

The FBI noted that after the stolen content is posted or sold, victims often “face re-victimization through harassment, sextortion, stalking or other targeted attacks, such as advertising stolen content on a victim's own social media page.”

The notice comes months after the Justice Department charged several people for conducting similar attacks.

A 27-year-old Illinois man pleaded guilty in February after the DOJ accused him of being behind a campaign of hacks involving the Snapchat accounts of about 600 women.

Last year, the DOJ indicted a former University of Michigan assistant football coach for hacking into the student athlete databases of more than 100 colleges and universities and accessing the medical information of about 150,000 people — using the data to break into the social media accounts of female student athletes.