FBI: Hackers using social engineering to breach accounts and steal explicit content
FBI warns hackers use social engineering and password-stuffing to hijack social media accounts and sell victims' explicit content on criminal marketplaces.
The FBI issued an alert on threat actors who breach social media accounts of adults and children using password-stuffing with credentials from data leak sites, impersonation of social media support staff, and cloned login pages, in order to steal and sell explicit content. Stolen content is often posted with victims' personal information, leading to sextortion, harassment, and stalking. Related DOJ cases include a man who pleaded guilty to hacking about 600 Snapchat accounts and a former University of Michigan coach who accessed records of about 150,000 people across 100+ colleges.
- Attackers try passwords and PINs sourced from data leak sites
- Fake support representatives trick victims into handing over reset codes
- Cloned social media login pages harvest credentials
- Victims face sextortion, harassment, and re-victimization after content is sold
Full article335 words · extracted from therecord.media · click to collapse
Hackers are breaking into the social media accounts of both adults and children to steal explicit content and sell it on criminal marketplaces, according to a new FBI alert released this week. In a notice on Monday, the bureau said threat actors are “using a variety of social engineering and cyber intrusion tactics to target specific individuals of interest — who may or may not be known to the actor — or general targets of opportunity.” The FBI added that the hackers are also posting personal information alongside the explicit content. Some cybercriminals break into accounts by repeatedly trying different passwords or PINs found on data leak sites and other sources. When victims are people they know, the hackers use different variations of their birthday or name. In other cases seen by FBI agents, hackers have contacted victims pretending to be social media company representatives claiming their accounts have been breached. They bombard victims with texts requesting password resets or with codes that allow the threat actors to reset the victim’s password themselves. The notice adds that some incidents involved cloned social media sites made to look like legitimate platforms. When login information is entered on the fake sites, it is sent to the cybercriminals. The FBI noted that after the stolen content is posted or sold, victims often “face re-victimization through harassment, sextortion, stalking or other targeted attacks, such as advertising stolen content on a victim's own social media page.” The notice comes months after the Justice Department charged several people for conducting similar attacks. A 27-year-old Illinois man pleaded guilty in February after the DOJ accused him of being behind a campaign of hacks involving the Snapchat accounts of about 600 women. Last year, the DOJ indicted a former University of Michigan assistant football coach for hacking into the student athlete databases of more than 100 colleges and universities and accessing the medical information of about 150,000 people — using the data to break into the social media accounts of female student athletes.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/social-engineering-hackers-explicit-photos-fbi-alert