WASHINGTON – When the Federal Bureau of Investigation describes intimate-image theft campaigns, it reaches for a particular detail: perpetrators are not only stealing victims’ private photographs and videos. In some cases, they are advertising the stolen content on the victims’ own social media pages. The bureau says that tactic, combined with extortion and relentless harassment, has driven some targets to self-harm.
The FBI issued a public advisory Monday identifying a significant shift in how these attacks unfold. Rather than soliciting intimate images directly, criminals are breaking into social media accounts to take them without any contact with the victim beforehand, as TechCrunch first reported. The FBI’s Internet Crime Complaint Center, known as the IC3, warned that both adults and minors are in the crosshairs.
Three distinct attack vectors are driving the intrusions, according to the advisory. In the first, criminals run high-volume password attempts against targeted accounts using credentials from past data breaches, often supplementing leaked passwords with personal details from public social media profiles (birthdates, team names, hometowns) to raise the odds that the attempt succeeds. In the second, perpetrators send texts to targets impersonating customer service representatives from platforms including Instagram, requesting verification codes under the pretense of account recovery. The third involves phishing emails built around fraudulent domains mimicking official support pages, directing victims to enter credentials or click malicious links.
Student-athletes are among the most frequently targeted demographics, the FBI said, because their public profiles provide attackers with ready-made personal details and an existing audience. Young boys are disproportionately affected, though the advisory noted that attacks extend to adults across demographics. What separates this wave from earlier forms of online sexual extortion is the entry point: the victim never knowingly sends anything.
Once attackers gain access, the stolen images and videos are sold on criminal marketplaces, frequently packaged alongside the victim’s personally identifiable information. That combination enables what the FBI describes as re-victimization. Stolen material resurfaces in extortion demands, stalking operations, and harassment campaigns involving multiple actors who have purchased or traded for the data. In some instances, perpetrators use the victims’ own accounts to advertise the stolen content to their followers. The bureau said that among the outcomes in documented cases, some victims have engaged in self-harm.
The pattern sits within a broader shift in cybercriminal tactics the FBI has flagged throughout 2026. In May, the bureau warned that Kali365, a Phishing-as-a-Service platform, was enabling attackers to bypass multi-factor authentication and gain persistent access to Microsoft 365 accounts using stolen authentication tokens, a method that requires no password entry from the victim. The techniques behind intimate-image theft differ in target and execution, but the underlying logic is the same: account access without the owner’s awareness.
To reduce exposure, the FBI recommends several protective steps. The bureau advises against storing intimate images on any internet-connected platform, including cloud storage, private messaging applications, and social media accounts. For account security, it recommends unique, complex passwords managed through a dedicated password manager, multi-factor authentication enabled across all accounts, and passwords constructed without personal details that an attacker could research from public profiles. Anyone receiving an unsolicited message from someone claiming to represent a platform’s support team should verify the contact through official channels only, not through numbers or links provided in the message itself.
The FBI instructs victims and witnesses to report incidents at ncii.ic3.gov, a site operated in partnership with the National Center for Missing and Exploited Children. The reporting form requests a timeline of events, the platforms involved, the locations where stolen content was posted, and any associated harassment.
The advisory contains no statistics on how many Americans have been affected, no financial tally of extortion payments, and no indication of how many criminal actors the bureau has identified or is actively pursuing. The IC3 filing made no reference to whether the FBI has coordinated with Meta, Snap, or other platform companies whose infrastructure is implicated in the attacks, or whether platform-level countermeasures are being developed in response.
That absence of scale data is consistent with a broader pattern in FBI cybercrime disclosure. In June, the bureau’s AI fraud count placed losses from AI-facilitated crimes at $893 million for 2025, a figure that independent researchers said captured fewer than five percent of actual incidents, given the stigma and complexity attached to filing a report. The dynamics around intimate-image theft suggest an even steeper undercount: the psychological barriers to disclosing sexual exploitation are substantially higher than those tied to financial loss.
The IC3 advisory was issued without a public comment from any of the platforms whose users are being targeted. It remains unclear whether the FBI has shared specific intelligence with Instagram, Snapchat, or other companies about the infrastructure being used in these attacks, or whether any coordinated response is in development. For now, the guidance runs in one direction, from the bureau to the public, with the platform half of the equation still unannounced.
Related Posts
