Hackers Exploit Meta AI Support to Hijack Instagram Accounts

Several users reported their Instagram accounts being compromised over the weekend, with hackers using Meta's AI-powered support chatbot to gain access. The issue has since been resolved by Instagram, but the exact number of affected users remains unclear.

Security researcher Jane Wong was among those whose account was taken over. "The password got changed without my knowledge and I was getting different password reset attempts throughout yesterday," she said. "Quite concerning." Wong's experience was not an isolated incident, as several other users on Reddit and X reported similar account hijackings.

A video posted on X showed the step-by-step process to hack someone's Instagram account. The hacker allegedly used a VPN to spoof the target's location to avoid triggering Instagram's automated account protections. Then, the hacker opened a chat with Meta AI Support Assistant and asked the bot to add a new email address to the target's account. The chatbot can be seen sending a verification code to the email address provided by the hacker; the hacker then shares the verification code with the chatbot, which prompts the chatbot to show a button to "Reset Password." The hacker enters a new password and takes over the victim's account.

TechCrunch was able to verify that the hacker's public email mailbox, which was displayed in the video, effectively received the verification code. The attack relied on the fact that at no point the hacker had to take over the legitimate email address linked to the victims' Instagram account.

On Monday, Instagram spokesperson Andy Stone said in a reply to Wong's post and others that the issue was now fixed. It's unclear how many Instagram users had their accounts improperly accessed. Meta did not immediately respond to TechCrunch's request for comment.

The incident highlights the potential risks of relying on AI-powered support chatbots. While they can be helpful, they can also be exploited by malicious actors. As the use of AI-powered chatbots continues to grow, it's essential to ensure that they are secure and cannot be easily manipulated by hackers.

Instagram has resolved the security issue that allowed several users' accounts to be hacked.
The attack relied on tricking Meta's AI-powered support chatbot into granting access to a victim's account.
Several users reported their Instagram accounts being compromised, including the Obama-era White House and the U.S. Space Force's chief master sergeant John Bentivegna.
The exact number of affected users remains unclear.
Meta did not immediately respond to TechCrunch's request for comment.

"The password got changed without my knowledge and I was getting different password reset attempts throughout yesterday," said security researcher Jane Wong, whose account was taken over.

This incident serves as a reminder of the importance of security and the need for companies to protect their users' data.

Do you have more information about these Instagram hacks? Or other flaws affecting Instagram? We'd love to hear from you. From a non-work device and network, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.