Hackers say they tricked Meta's AI chatbot into giving them access to other people's Instagram accounts, and all they had to do was ask and this is according to claims shown in screenshots and videos shared on social media and Instagram's AI chatbot allowed users to hijack accounts. Hackers could reportedly change passwords for other accounts by faking their location and then asking the AI to change the emails associated with them. "This issue has been resolved, and we are securing impacted accounts," Meta spokesperson Andy Stone said to users on X. Responding to another X post Stone said claims the vulnerability was used to hack into accounts of world leaders was not true.[1]
404 Media said that posts about the vulnerability coincided "with a series of high-profile Instagram account takeovers" including a verified account used by Barack Obama when he was in the White House. The former US president's account reportedly posted pro-Iran content before it was recovered.
Among those claiming to have been impacted were security researcher and former Meta employee Jane Manchun Won, who previously worked at Meta as a security engineer, said on X that her Instagram password was "changed without my knowledge" and she had repeatedly seen different password reset attempts and she said it is "Quite concerning". The incident comes amid concerns about the impact of increasingly capable and common AI systems on people's data and security.
Videos shared on social media purported to show how Instagram hacks could take place. One, shared by cyber security researcher Dark Web Informer on X, showed someone searching for the username of an account they wished to gain access to as part of Instagram's recovery process. They were also shown to be using a virtual private network (VPN) service to pretend to be in the real account holder's location.
After selecting the account, they wanted to access, they sent a message to Instagram's Meta AI support assistant asking to link a new email to the account and send it a verification code. The bot followed through with the request, sending a code to the hacker's email which, when verified, was followed by an email with a link to change their password.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/ai-chatbot-used-to-get-instagram-account-access-9464.html
Comments