FBI: Watch Out for Hackers Trying to Steal Your Nude Photos | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

If you like taking nude photos, be careful: The FBI is warning that hackers have been trying to steal “explicit content” with the goal of selling or sharing the images.

The hackers have been targeting adults and underage users by breaking into social media and personal online accounts, according to the FBI’s warning, which was published on Monday. 

“Once the sexually explicit images or videos are accessed and stolen, typically unbeknownst to the victim, SE [sexual exploitation] actors are sharing or posting the content within community forums or selling them to illicit marketplaces,” the agency added. 

The threat is particularly disturbing since the stolen nudes are often circulated with contact information about the victim. That’s likely because the account hijacking can also pave the way for the culprits to learn details about the victim. 

“Personally identifiable information—such as name, date of birth, email, phone number, and social media username—is often posted along with the victim’s explicit content, exposing them to continued re-victimization,” the agency noted. The re-victimization can include sextortion threats, which involve demanding the victim pay up, otherwise their nudes will be widely leaked.  

To break into the accounts, the hackers will use password-guessing attacks, leveraging known login credentials compiled from past data breaches. Some online services and social media platforms can block such attempts by requiring anyone logging in to enter the verification code sent to their phone. But according to the FBI, the culprits have a workaround: impersonating the online provider’s customer support. They’ll do so by sending a text message to the victim, claiming that their social media account is being disabled or locked unless they respond with the verification code. 

“SE actors then request a password reset for the victim’s social media account, which generates a code and is sent to the victim. Once the victim shares the code, the SE actor can reset the victim’s password and access the account,” the FBI noted. 

The other tactic the hackers have been using involves creating “look-alike domains and email accounts emulating social media customer support to notify victims about ‘new logins’ into their account,” the warning says. The resulting email messages to the victims will try to trick them into visiting and typing their password into a look-alike site that’s actually controlled by the hacker. 

The FBI’s warning is a good reminder to secure your online accounts with multi-factor authentication and to be vigilant about what you upload to a cloud service, even if it’s only posted to a private folder. The FBI also says users should be on guard against phishing messages and urges victims to report the crime to the agency.