Loading story…
The FBI warned that cybercriminals are compromising adults’ and children’s online and social media accounts to steal intimate photos and videos, then using the material for sextortion, harassment, stalking, and public exposure. The activity involves sexual exploitation actors who obtain explicit content and threaten to leak or advertise it online, including by posting stolen material on victims’ own social media profiles.
According to the alert, attackers are gaining access through social engineering, phishing pages on lookalike domains, brute-force attempts, and credential attacks using leaked or reused passwords, while some also impersonate platform customer support staff such as Instagram representatives. The warning highlights an ongoing account-takeover campaign targeting social media users, with particular concern for younger victims whose stolen content may be distributed publicly to intensify extortion pressure.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
In March 2025, federal prosecutors indicted former University of Michigan football coach Matthew Weiss on computer-access and identity-theft charges. Prosecutors alleged he obtained athlete data from more than 100 colleges and universities, used it to access thousands of accounts, and downloaded private intimate photos and videos.
The FBI issued a public warning that cybercriminals are compromising social media and other online accounts belonging to adults and children to steal intimate explicit images and videos. The advisory said attackers use social engineering, brute-force attempts with leaked or reused passwords, phishing pages on lookalike domains, and impersonation of platform support staff, then extort or harass victims and sometimes publish the stolen content online.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
9 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcetherecord.media
Open sourcezdnet.com
Open sourcetechrepublic.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcemalware.news
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new wave of **sextortion emails** is using the familiar “Hello pervert”/“I recorded you” template, falsely claiming the recipient was infected via a *drive-by exploit* and recorded through their webcam. To increase credibility, the messages include a real password associated with the target and demand payment (e.g., **$800 in Bitcoin**) to prevent alleged video/data release; the password reuse strongly suggests sourcing from **previous data breaches** and credential dumps rather than any actual device compromise. Guidance for recipients emphasizes treating these messages as scams: **do not pay**, stop engagement, preserve evidence, and report to appropriate authorities (e.g., **FBI IC3** in the US). Separately, phishing activity impersonating **United Healthcare** has been observed using a “free Oral-B toothbrush” lure and **IPv6-mapped IPv4 literals** (e.g., `http://[::ffff:5111:8e14]/` → `81.17.142.20`) to obfuscate scam infrastructure and route victims to rotating landing pages aimed at stealing **PII and payment card data**—a distinct fraud technique from the sextortion emails but similarly focused on social engineering and monetization.
Jul 12, 2026
The FBI and IC3 warned that **nihilistic violent extremist networks** and broader communities known as **"The Com"** are targeting children and other vulnerable people online through extortion, coercion, stalking, and abuse. Federal notices said the groups operate across social media, messaging apps, gaming platforms, and other online services, using threats, manipulation, and criminal tradecraft to pressure victims into self-harm, sexual exploitation, violence, and other dangerous acts in the United States and abroad. Reporting and law-enforcement disclosures tied those networks to a wider cybercrime ecosystem that overlaps with groups linked to major intrusions, SIM swapping, credential theft, doxing, swatting, sextortion, and ransomware activity. CyberScoop reported federal investigators were probing **764** and related actors for using cybercriminal methods to facilitate violent crimes, while KrebsOnSecurity described connections among harm groups, **Scattered Spider**, **LAPSUS$**, and other actors associated with breaches and abuse campaigns. Separate FBI outreach on malware hidden in games hosted on **Steam** underscored how gaming platforms are also being used to reach and victimize users, especially younger targets.
Jun 29, 2026
A wave of threatening email campaigns is using intimidation and recycled data to pressure recipients into paying attackers. One campaign sent sextortion emails demanding **$2,000 in Bitcoin**, falsely claiming the sender had hacked victims’ devices, activated cameras and microphones, and recorded visits to adult websites. Reporting indicates the messages relied on email addresses exposed in earlier **ShinyHunters-linked** data leaks, with criminals referencing companies associated with the recipient’s address to make the threats appear credible. Betterment said some customers received the emails and emphasized that possession of an email address alone does not give an attacker access to a device. A separate warning from **CERT Bulgaria** described a campaign of threatening emails about allegedly planted explosive devices, underscoring a broader pattern of coercive messaging designed to trigger fear rather than reflecting confirmed compromise. Together, the incidents show how threat actors are repurposing previously leaked personal data and high-pressure hoax narratives to drive extortion and social engineering, while security authorities and affected organizations stress that recipients should treat the claims as fraudulent unless independent evidence shows an actual intrusion.
Aug 10, 2026