Devices and methods for detecting a compromised social media account are disclosed. A method includes: receiving, by a computing device, social media content corresponding to a plurality of social media accounts; determining, by the computing device, a plurality of affinity groups, each including two or more social media accounts from the plurality of social media accounts, based upon the received social media content; determining, by the computing device, whether or not a particular social media account of the plurality of social media accounts is compromised using the received social media content and the determined plurality of affinity groups; and in response to determining that the particular social media account is compromised, the computing device providing a notification indicating that the particular social media account is compromised.