FBI Warns of Sextortion Attacks Targeting Social Media Accounts

The FBI is warning that cybercriminals are targeting the social media and online accounts of adults and children to steal sexually explicit images and videos.

According to a public service announcement released this week, attackers may use stolen intimate content to blackmail victims, sell the material on criminal marketplaces, or distribute it without their consent.

Cybercriminals may also collect and share personal information—including a victim’s name, date of birth, email address, phone number, and social media username—with other offenders. Those criminals can then use the information to pressure victims into sending additional private images or videos as part of a sextortion scheme.

Sextortion is a form of online extortion in which criminals threaten to publish nude images or videos obtained through hacking, deception, or coercion. In some cases, offenders demand money in exchange for keeping the content private or threaten to send it to the victim’s family, friends, classmates, or coworkers.

“Once sexually explicit content is stolen, SE actors post or sell it to criminal marketplaces, often including the victim’s personal information, and usually without the victim’s knowledge,” the FBI warns.

“As a result, victims often become re-victimized through harassment, sextortion, stalking, or other targeted attacks such as promoting stolen content on the victims’ own social media pages.”

FBI warns student athletes about sexual exploitation schemes

The FBI and the National Collegiate Athletic Association (NCAA) also warned that cybercriminals are targeting student-athletes’ online accounts in sexual exploitation schemes. The agencies urged coaches, compliance staff, and athletic leaders to raise awareness about these threats in schools and local communities.

The FBI advises potential victims not to respond to unsolicited text messages or emails asking for verification codes, temporary passwords, or PIN reset codes. Users should also avoid clicking password-reset links in unexpected messages and should not store explicit photos or videos on social media accounts or publicly accessible websites.

Using unique, complex passwords and enabling multi-factor authentication can provide additional protection for social media, email, and other online accounts.

“The FBI has identified several indicators associated with these schemes, including unsolicited text messages claiming that your account will be disabled without a verification code, and unsolicited emails referencing a new login with an embedded link to reset your password.”

“The FBI advises that legitimate platforms and services do not require verification codes, temporary passwords, or PIN reset codes from account holders. Using passwords and PINs that do not include personal information such as name, date, date of birth, or other easily accessible information can also help reduce the risk of harm.”

How to respond to an online sextortion threat

The FBI has not said what prompted the latest warning, but the agency frequently issues public service announcements after identifying increases in reported criminal activity.

People who receive sextortion threats should avoid sending money or additional images, stop communicating with the offender, preserve relevant messages and account information, and report the incident to law enforcement and the affected online platform. Victims should also seek support from a trusted adult, family member, school official, or counselor.

Almost five years ago, in September 2021, we reported on a significant increase in sextortion complaints and advised victims to immediately stop interacting with offenders and contact law enforcement.

Sextortion can result in severe criminal penalties. In May, a Canadian man was sentenced to 33 years in prison after targeting more than 145 children across the United States—including victims as young as six—in an eight-year sextortion scheme.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report