Simple Hacks Exposing Instagram Users to Risk
Hackers have been exploiting Meta's AI support chatbot to take over Instagram accounts, with the company scrambling to secure the targeted accounts and alert victims.
The widespread hacking campaign appears to have continued even after Meta said the issue had been resolved. Hackers simply told Meta's AI chatbot that they were the owners of the target's account, and asked the bot to link that person's account to an email they controlled. The chatbot complied with the request, allowing the hacker to reset the target account's password and take control of the account — in some cases locking out the victims.
At no point were Meta employees or contractors involved in the chat.
On Monday, Meta spokesperson Andy Stone said that “the issue that did happen has already been fixed.” However, more Instagram users claimed to have had their accounts hacked on Tuesday.
TechCrunch has seen discussions among members of a Telegram channel where the hacking technique had been publicized, who claimed to still be able to exploit Meta's AI chatbot, and they were advertising apparently hacked handles for sale, including at the time of TechCrunch's writing.
Hacked Accounts Sold as 'OG Handles'
The hackers were selling the allegedly hacked handles featuring common forenames or names of countries, which can be then re-sold almost as collectibles in a gray market for so-called “OG handles.”
Other victims of the hacking spree appeared to be the dormant Obama White House account (which Meta disputed), and the account of the U.S. Space Force's chief master sergeant John Bentivegna.
Meta's Response
Meta has been scrambling to secure the targeted accounts and alert victims. Victims publicly reported receiving emails from Instagram warning them that the company had “detected some suspicious activity that suggests your Instagram may have been compromised.” The message also said that the company took measures to secure the account, and asked the user to reset their password.
A Simple yet Effective Hack
The hacking technique was so simple that calling them hacks may be giving the people behind them too much credit, while at the same time not putting enough blame on Meta for not preventing rudimentary attacks from hijacking people's accounts.
For years, there has been a flourishing market where hackers stole and then sold "OG" usernames, referring to the usernames and handles taken by the earliest users of Instagram. In the past, however, taking over those accounts required more complex strategies, such as phishing the victim, taking over their phone number, or bribing insiders at telecom providers.
Here, the hackers just asked, and Meta's chatbot dutifully complied.
Contact Us
If you have more information about these Instagram hacks, please contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.