FBI Warns of Cybercriminals Stealing and Selling Private, Explicit Content via Social Engineering

The Federal Bureau of Investigation has issued a warning regarding a growing cyber threat where hackers employ social engineering, compromised credentials, and fraudulent social media platforms to hijack personal accounts. Once inside, these bad actors target highly sensitive, explicit media belonging to individuals, subsequently selling the stolen content on various online marketplaces.

According to details from the federal law enforcement agency, first reported by the cybersecurity news outlet The Record, attackers are utilizing a multifaceted approach to gain unauthorized access. Rather than relying solely on sophisticated technical exploits, they frequently exploit human vulnerabilities. This includes deploying deceptive social engineering tactics to trick victims into revealing sensitive information or bypassing security protocols.

In addition to manipulation, cybercriminals are leveraging databases of previously leaked passwords to conduct credential stuffing attacks. Because many internet users reuse passwords across multiple platforms, a breach at one website can grant hackers access to more secure personal accounts elsewhere. The FBI also highlighted the use of spoofed social media login pages, which mimic legitimate platforms to harvest usernames and passwords directly from unsuspecting users.

Once the attackers successfully breach an account, they search for private, intimate, or explicit photos and videos. This content is then commodified, often ending up on underground forums, specialized websites, or messaging app channels where it is sold for profit. Beyond the financial motivation of the hackers, this trend poses severe psychological, reputational, and privacy risks to victims.

Security experts emphasize that defending against these types of attacks requires a combination of strong technical safeguards and heightened user awareness. Because social engineering bypasses traditional technical protections by targeting the user directly, recognizing the signs of phishing—such as urgent requests to verify account details or unusual login links—is critical.

To mitigate these risks, federal authorities and cybersecurity professionals recommend that individuals implement robust digital hygiene practices. This includes utilizing unique, complex passwords for every online account and enabling multi-factor authentication (MFA) wherever possible. Taking these steps significantly reduces the likelihood of unauthorized access, even in cases where a password has been compromised.