Hackers Hijack Instagram Accounts through Meta AI Chatbot
Security experts have sounded the alarm after several users reported their Instagram accounts were compromised, with hackers apparently using Meta's own AI-powered support chatbot to gain access.
The attack, which was first reported over the weekend, appears to have relied on the chatbot being tricked into granting access to a victim's account. According to a video posted on X, the hacker used a VPN to spoof the target's location, then opened a chat with the Meta AI Support Assistant and asked the bot to add a new email address to the target's account.
The chatbot can be seen sending a verification code to the email address provided by the hacker, which was then shared with the chatbot. The hacker then entered a new password and took over the victim's account.
TechCrunch was able to verify that the hacker's public email mailbox received the verification code. The attack did not require the hacker to take over the legitimate email address linked to the victim's Instagram account.
"The password got changed without my knowledge and I was getting different password reset attempts throughout yesterday," said Jane Wong, a security researcher whose Instagram account was taken over.
"Quite concerning." Wong's account was one of several compromised, including the Instagram handle for the Obama-era White House and the account of the U.S. Space Force's chief master sergeant John Bentivegna.
On Monday, Instagram spokesperson Andy Stone said in a reply to Wong's post that the issue was now fixed. However, it's unclear how many Instagram users had their accounts improperly accessed.
- The attack highlights the need for robust security measures to protect user accounts and prevent unauthorized access.
- Meta's reliance on AI-powered chatbots may leave the platform vulnerable to similar attacks in the future.
- Instagram users are advised to monitor their accounts closely and report any suspicious activity immediately.
Meta did not immediately respond to TechCrunch's request for comment.