FBI, French authorities seize deepfake CSAM-for-sale websites

The FBI and the cybercrime division of the French Paris Prosecutor's Office seized the websites NudeLeaksTeens and NLTVIDS and arrested an unnamed 25-year-old French resident suspected of being their primary administrator, according to a seizure warrant filed Oct. 2 in the Eastern District of Virginia. The sites advertised and sold child sexual exploitation material, including AI-generated deepfake media, with one collection of 189GB covering 315 girls priced at $64.90, and the Justice Department said the operation targeted content violating the TAKE IT DOWN Act. FBI officials executed a search warrant on Reston, Virginia-based domain registry VeriSign, taking servers, computers and other material.

FBI, French authorities seize deepfake CSAM-for-sale websites The FBI and French authorities have arrested an individual and seized a pair of websites that were used to disseminate child sexual exploitation material, including AI generated deepfake media, according to court documents. The websites, NudeLeaksTeens and NLTVIDS, were seized and shut down by the FBI this week. According to the Department of Justice, the cybercrime division of the French Paris Prosecutor’s Office has also arrested https://www.justice.gov/usao-edva/pr/international-law-enforcement-operation-leads-seizure-websites-used-traffic-child an unnamed 25-year-old French resident suspected of being the primary administrator for the sites. According to a seizure warrant https://storage.courtlistener.com/recap/gov.uscourts.vaed.607511/gov.uscourts.vaed.607511.7.0.pdf filed Oct. 2 in the Eastern District of Virginia by Arlington County police detective and FBI cybercrime task force member John Bamford, law enforcement first became aware of the websites in 2024, which advertised hacked, leaked and stolen CSAM of young girls. FBI officials executed a search warrant on VeriSign, a Reston, Virginia-based U.S. domain registry that controls the seized website domains, taking servers, computers and other material. Together the sites offered “a wide range of explicit content including CSAM and content that violates the TAKE IT DOWN Act, which prohibits the non-consensual sharing of intimate images,” Bamford wrote. The TAKE IT DOWN Act, passed last year https://cyberscoop.com/take-it-down-act-passes-house-first-amendment-encryption/ , makes it a crime to create or share nonconsensual “intimate” deepfake media of real people. The law also gives https://cyberscoop.com/ftc-take-it-down-act-enforcement-deepfakes/ the Federal Trade Commission authority to enforce it and allows courts to order websites to remove such content. The sites posted explicit disclaimers disavowing child pornography while simultaneously advertising and selling CSAM. At least one had its own form of currency used to buy images and videos individually or bundles organized by victim. One collection, containing 189GB of material on 315 different girls, sold for $64.90. Some of the material came from victims’ social media accounts on Snapchat, TikTok, Instagram and Facebook, either recorded directly or stolen from their accounts. Several victims who appear on the site reported to law enforcement that their accounts were hacked. Some of the advertised collections were compiled by individuals now serving prison sentences for their crimes. One individual, Andrew Venegas, pled guilty in a Texas federal court to sexual exploitation of children and receipt of CSAM as was sentenced to 30 years in prison in April 2026. “In the investigation and prosecution of Venegas, law enforcement learned that Venegas obtained sexually explicit images and videos of his victims in various ways, including extortion and the unauthorized accessing of victim social media accounts,” wrote Bamford. A separate collection available for sale on one of the sites in 2022 and 2023 was named after an individual, Reuben Oswaldo Yeverino Rosales, who was convicted and sentenced to more than 34 years in prison in 2022 for sexual exploitation of children and cyber stalking. The websites put up disclaimers stating that they do not host or store any files or images on their servers, but rather link to “other non-affiliated sites” that do. Administrators would often encourage payments in cryptocurrency and urge individuals to reach out to them personally for some material, rather than posting them on the site.