Your Instagram account can be hacked! Hackers tricked Meta AI to gain account access

Hackers are manipulating Meta’s own artificial intelligence (AI)-powered chatbot assistant to gain access to people's Instagram accounts. Several users on Reddit and X shared that their Instagram accounts had been compromised, and many started to speak out about the account hijackings.

Between May 30 and May 31, several Instagram accounts were reported to be hacked, with some of the high-profile accounts, like the Obama White House's Instagram page and John Bentivegna, the chief master sergeant of the United States Space Force, were also impacted. Security researcher Jane Wong also shared on X that her Instagram account has been hacked. 

Must read: Meta may soon charge for premium features on Instagram, Facebook and WhatsApp

“The password got changed without my knowledge, and I was getting different password reset attempts throughout yesterday. And I got repeatedly logged out from the IG iOS app,” Wong said in the post.

On June 1, Instagram spokesperson Andy Stone replied to Wong’s post, saying that the security issue had been fixed that previously allowed hackers to manipulate Meta's AI support chatbot to redirect password reset codes to their own email accounts. This gave them unauthorised access to people’s Instagram accounts.  

How hacked tricked Meta AI chatbot?

According to the video shared by Dark Web Informer on X, the attacker used a VPN to spoof the victim's location to pass Instagram's automated security checks. Then, it opened a conversation with Meta's AI support assistant and asked the chatbot to add a new email address to the targeted Instagram account.

Must read: WhatsApp to allow users hide phone numbers with a username: Know how you can setup

Then, a verification code is sent by the chatbot to the email address provided by the attacker, and it is shared with the chatbot. After code verification, the chatbot showcases a "Reset Password" option, where the attacker sets a new password for the account. With the password changed, the attacker gained control of the victim's Instagram account.

While this raises concerns over Meta’s two-factor authentication (2FA), but it is suggested that people with 2FA were not impacted by the security threat. Users may want to strengthen their account protections by enabling or reviewing their security settings, particularly two-factor authentication.