Instagram has resolved a security issue that allowed several users\u2019 accounts to get hacked. The attack appeared to rely on tricking Meta\u2019s own AI-powered support chatbot into granting access to a victim\u2019s account.<\/p>\n
Over the weekend, several<\/a> users<\/a> on Reddit claimed that their Instagram accounts had been compromised, and a number<\/a> of<\/a> users<\/a> on X warned of similar account hijackings. The compromised accounts include the Instagram\u00a0handle for the Obama-era White House<\/a>, which appears to have been inactive since 2017; and the account of the U.S. Space Force\u2019s chief master sergeant John Bentivegna<\/a>.<\/p>\n Security researcher Jane Wong said her Instagram account was also taken over.\u00a0<\/p>\n \u201cThe password got changed without my knowledge and I was getting different password reset attempts throughout yesterday,\u201d said<\/a> Wong. \u201cQuite concerning.\u201d\u00a0<\/p>\n A video<\/a> posted on X showed the step-by-step process to hack someone\u2019s Instagram account. The hacker allegedly used a VPN to spoof the targets\u2019 presumed location to avoid triggering Instagram\u2019s automated account protections. Then, the hacker opened a chat with Meta AI Support Assistant and asked the bot to add a new email address to the target\u2019s account. The chatbot can be seen sending a verification code to the email address provided by the hacker; the hacker then shares the verification code with the chatbot, which prompts the chatbot to show a button to \u201cReset Password.\u201d The hacker enters a new password and takes over the victim\u2019s account.\u00a0<\/p>\n \t\t\tContact Us TechCrunch was able to verify that the hacker\u2019s public email mailbox, which was displayed in the video, effectively received the verification code.\u00a0<\/p>\n The attack relied on the fact that at no point the hacker had to take over the legitimate email address linked to the victims\u2019 Instagram account.\u00a0<\/p>\n On Monday, Instagram spokesperson Andy Stone said in a reply<\/a> to Wong\u2019s post and others that the issue was now fixed. It\u2019s unclear how many Instagram users had their accounts improperly accessed.<\/p>\n Meta did not immediately respond to TechCrunch\u2019s request for comment.<\/p>\n
\n\t\t\tDo you have more information about these Instagram hacks? Or other flaws affecting Instagram? We\u2019d love to hear from you. From a non-work device and network, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email<\/a>.<\/a>\t\t<\/p>\n