FBI Warns of Intimate-Image Account Hijacking

The FBI has warned that cybercriminals are increasingly hijacking social media and personal accounts to steal intimate photos and videos, which can then be distributed or sold without the victim’s consent.

The stolen material, described by the FBI as non-consensual intimate images (NCII), may be uploaded to criminal marketplaces alongside personal information such as names, phone numbers, email addresses and social-media profiles. This combination can expose victims to harassment, stalking, identity abuse and sextortion.

Attackers are using several methods to gain access. One involves password and PIN guessing, using information obtained from previous data breaches, leak sites, social-media profiles and predictable personal details such as names and birth dates.

Another technique involves fake customer-support messages. Criminals warn victims that their social-media accounts are about to be suspended, trigger a legitimate password-reset process and then manipulate victims into revealing the verification code. Once obtained, the attacker can take control of the account.

Phishing remains another major route. Fraudsters create convincing support emails and lookalike domains warning about suspicious logins. Victims are directed to fraudulent password-reset pages where their credentials are captured.

Account Takeover Becomes Personal

These attacks demonstrate how account compromise is evolving beyond financial or identity theft. Once criminals gain access to private digital content, personal data itself becomes a weapon for coercion and exploitation.

Users should adopt unique passwords, password managers and phishing-resistant multi-factor authentication, while never sharing password-reset or verification codes with anyone claiming to provide customer support.

The key security principle is simple: protecting an account now means protecting not only your identity, but your most private digital life.