Attackers use search engines (Google Dorking) with queries like intitle:"index of" /images to find these open folders automatically. Data Scraping:
Several high-profile cases have highlighted the risks associated with parent directory indexing: parent directory index of private images new