LIVE · cybersecurity feed
ai

Meta’s own AI chatbot to blame for Instagram accounts being stolen in seconds

zeroday.news·33d ago

Cybercriminals are reportedly exploiting a vulnerability in Meta's AI-powered support chatbot to gain unauthorized access to Instagram accounts. The method, which requires no specialized technical expertise, allows attackers to hijack accounts rapidly and at scale.

The exploitation hinges on the interaction between users and Meta's AI chatbot, which is designed to assist with account recovery and support issues. While the specifics of the exploit are not detailed, the process appears to leverage the chatbot's functionalities to bypass standard security measures.

This attack vector bypasses the need for traditional hacking techniques such as brute-force attacks or phishing. Instead, attackers are able to manipulate the chatbot's responses or exploit its decision-making process to gain control of user accounts.

The ease with which accounts can be compromised raises significant concerns about the security of Meta's support infrastructure and the potential for widespread account takeovers. The ability for attackers to operate "at scale" suggests a systematic approach to exploiting this vulnerability.

Instagram users are advised to remain vigilant regarding their account security. While specific mitigation steps for this particular exploit are not yet publicly available, general best practices for account security remain crucial.

This includes enabling two-factor authentication on all accounts, using strong and unique passwords, and being cautious of any unsolicited communications or requests for personal information. Users should also regularly review their account activity for any suspicious behavior.

The incident highlights the growing risks associated with AI-powered support systems and the need for robust security protocols to prevent their misuse. As AI becomes more integrated into online services, ensuring the security of these systems is paramount.

Meta has not yet issued a public statement regarding this specific exploitation of its AI chatbot. Further details on the vulnerability and potential countermeasures are anticipated as the situation develops.

ai
← Back to latest

More News

view all →
zeroday.news · 3h ago·high

Operationalizing Day Minus Seven: The Cloud-Native ROC

The article introduces the concept of a Risk Operations Center (ROC) as a necessary evolution for cybersecurity teams facing AI-driven threats. It argues that traditional risk management models are insufficient due to the speed at which AI can discover and exploit vulnerabilities, especially in cloud environments. A ROC, powered by platforms like Qualys Enterprise TruRisk Management (ETM), aims to unify disparate security findings, hyper-prioritize risks based on exploitability and business impact, and enable autonomous remediation to keep pace with attackers.

zeroday.news · 4h ago·high

3 Ways AI Powers Service Desk Attacks and How to Prevent Them

Artificial intelligence is increasingly being used by attackers to enhance service desk attacks, particularly during employee onboarding. AI tools can create more convincing impersonations, accelerate reconnaissance for personalized attacks, and scale malicious campaigns. To counter these threats, organizations need to implement stronger identity verification methods, such as secure password delivery, biometric liveness detection, and multi-factor authentication before sensitive actions are approved.

zeroday.news · 3h ago·high

China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors

A China-linked advanced persistent threat (APT) group, identified as LapDogs, has reportedly enhanced its malicious toolkit. Security researchers have observed the deployment of three new backdoors: LongLeash, DogLeash, and JarLeash, which are designed to compromise small office/home office (SOHO) routers.

zeroday.news · 3h ago·high

RedWing Android Spyware Sold as a Service on Telegram

A new Android spyware called RedWing is being offered as a service on Telegram, allowing less sophisticated attackers to compromise phones and steal banking information. Researchers have identified it as a polished malware-as-a-service operation with extensive documentation and a subscription model, potentially linked to Russian threat actors. RedWing employs fake login overlays, SMS interception, call forwarding, and even screen control to harvest credentials and conduct further malicious activities.

zeroday.news · 4h ago·critical

Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS

Ubiquiti has released security updates to address several critical vulnerabilities affecting its UniFi product line, including UniFi Connect, Talk, Access, Protect, and OS. These flaws could allow attackers to escalate privileges or execute arbitrary commands on affected devices. While no active exploitation has been reported for these specific vulnerabilities, the company has previously seen its UniFi OS and Edge OS products targeted by threat actors.

zeroday.news · 4h ago·high

Armored Likho Hits Government, Energy Sectors With BusySnake Stealer

Cybersecurity researchers have identified a new threat actor, dubbed Armored Likho, targeting government and energy sectors in Russia, Kazakhstan, and Brazil with a sophisticated phishing campaign. The operation utilizes a custom-built Python infostealer named BusySnake, designed to steal credentials, sensitive documents, and other high-value data. The attackers employ AI-generated payloads to obscure their activities and maintain persistence through various methods, including reverse SSH tunneling.