Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts
Instagram accounts, including those belonging to the Obama White House and the Chief Master Sergeant of the U.S. Space Force, were temporarily defaced with pro-Iranian content following the discovery of a method to exploit Meta's AI support bot for account takeovers. Instructions detailing this exploit began circulating on Telegram, demonstrating how to manipulate the AI assistant into resetting account passwords.
The exploit reportedly involved using a VPN connection with an IP address geographically close to the target's usual location. Attackers would then initiate a password reset for a specific Instagram account and opt to interact with Meta's AI support assistant. According to a video shared on Telegram, the attacker would instruct the bot to associate the targeted account with a new email address. The AI, in turn, would send a one-time code to this newly provided email, enabling the attacker to reset the account's password.
The Telegram account responsible for sharing the exploit also posted screenshots of pro-Iran imagery, videos, and messages used to deface the compromised Instagram accounts. The group claimed to have used this vulnerability to seize several "valuable" Instagram account names, with an alleged resale value exceeding half a million dollars.
Meta has not publicly commented on the specific claims made in the video. However, Andy Stone of Meta stated on Twitter/X that the issue has been resolved and that affected accounts are being secured. Reports from the security blog thecybersecguru.com indicate that Meta deployed an emergency patch over the weekend and confirmed that no backend databases were breached.
The security blog highlighted Instagram's historically limited human customer support infrastructure, noting that recovering a locked account, particularly a high-value one, can involve lengthy interactions with automated ticketing systems. Meta's implementation of a conversational AI layer was intended to streamline common account recovery processes, such as relinking email addresses, initiating password resets, and verifying account ownership, thereby reducing difficulties for legitimate users.
Ian Goldin, a threat researcher at Lumen's Black Lotus Labs, commented that the increasing use of AI chatbots by major online platforms to handle sensitive account recovery requests marks a new and uncharted security territory. He drew a parallel between human customer support agents who can be socially engineered and AI bots, suggesting that AI assistants are equally susceptible to persuasion and trickery. Goldin anticipates that AI chatbots will present new attack surfaces, leading to a rise in similar types of attacks.
Goldin also advised users to enhance their online account security by enabling the most secure form of multi-factor authentication (MFA) available, such as passkeys or security keys. The attackers themselves reportedly stated that their exploit was ineffective against accounts protected by MFA. Even the less robust form of MFA offered by Instagram, which involves sending a one-time code via SMS, would likely have prevented this particular exploit.
