A group of attackers allegedly took over Instagram accounts by persuading Meta’s AI-powered support chatbot to replace the email addresses associated with those accounts. Once the email address was changed, they could request password resets and gain control of the profiles.
The campaign focused on valuable usernames and high-profile accounts, with screenshots and videos circulating in Telegram groups showing how the process worked.
Meta has since said it fixed the issue and secured affected accounts, though questions remain about how many users were impacted.
Why It Matters: The reported exploit turned a customer support function into an identity and access management issue. Attackers allegedly gained control of accounts by convincing an AI system to modify account recovery information, raising questions about how organizations govern automated systems that can perform security-sensitive actions.
- AI Chatbot Enabled Account Takeovers: Videos and screenshots shared in Telegram groups showed a straightforward process. Attackers would initiate a password reset, contact Meta’s AI support chatbot, and request that a new email address be linked to the target account. The chatbot would send a verification code to the attacker-controlled email address, allowing the attacker to complete the password reset process and gain access to the account. No employee intervention was required.
- High-Value Accounts Were Targeted: Telegram channels discussing the technique circulated lists of desirable Instagram handles, including short usernames, common names, dictionary words, and country names. These “OG handles” can command significant prices in underground markets because of their rarity. The campaign was also linked to accounts associated with Sephora, the Barack Obama White House account, and U.S. Space Force Chief Master Sergeant John Bentivegna.
- AI Support Became A Security Function: Earlier this year, Meta introduced AI-powered support capabilities designed to help users recover accounts and resolve security issues. Company materials described a system capable of handling account recovery from start to finish. The reported exploit suggests that support tools become security-sensitive systems when they are authorized to modify account recovery information.
- The Technique Spread Through Telegram: Telegram groups became hubs for sharing instructions, screenshots, videos, and target lists. Some participants claimed that using a VPN connected to the same country or region as the target account improved their chances of success. Whether every reported compromise used the same technique remains unclear, but discussions showed how easily the process could be shared among interested attackers.
- Meta Secured Accounts And Issued Alerts: The company stated that it fixed the issue and began securing affected accounts. Users reported receiving warnings that suspicious activity suggested their accounts may have been compromised, along with instructions to reset passwords. Some users and participants in Telegram channels claimed account takeovers continued after the fix was announced. Meta has not disclosed how many accounts were affected.
Instagram is alerting users who were targeted by hackers during AI chatbot attacks – TechCrunch
Trusted insights for technology leaders
Our readers are CIOs, CTOs, and senior IT executives who rely on The National CIO Review for smart, curated takes on the trends shaping the enterprise, from GenAI to cybersecurity and beyond.
Subscribe to our 4x a week newsletter to keep up with the insights that matter.
