cyber.hendryadrian.com
Cyber Attack & Data Breach · securityweek.com

Hackers Exploited Meta AI Recovery Flaw to Take Over Instagram Accounts

· Original article ↗

Summary

Hackers reportedly exploited a logic flaw in Meta’s AI account recovery assistant to take over Instagram accounts. Meta has fixed the issue, but the number of affected accounts is unclear.

Key points

  • The AI assistant reportedly linked attackers’ email addresses to targeted accounts, enabling password resets and account takeovers.
  • Attackers used VPNs to appear to be in victims’ locations and, when prompted, reportedly submitted AI-altered victim photos for verification.
  • The article says the takeovers bypassed two-factor authentication, and some victims reported receiving no password-reset notifications.
  • Hundreds of high-profile accounts were reportedly compromised and sold; named targets included the Obama White House handle, Sephora, and Space Force Chief Master Sergeant John Bentivegna.
  • Meta has resolved the flaw, but the number of affected accounts remains unclear.

Article Details

Victim Organization
Instagram account holders, including the Obama White House, Sephora, and John Bentivegna
Incident Type
Account takeover through a logic flaw in Meta’s AI-powered account recovery assistant
Affected Records
Hundreds of high-profile accounts were reportedly compromised.
Operational Impact
Attackers reportedly linked their own email addresses to targeted accounts, reset passwords, and locked rightful owners out. Some accounts were reportedly sold on the dark web. Meta resolved the issue, and the exploit no longer works.
Ransom Or Extortion
Not disclosed; the article reports that compromised accounts were sold on the dark web.
Claim Status
alleged

People

Dan MooreFusionAuth senior director who commented on the incident, describing AI agent authorization as a key security concern.

Vendors

MetaThreat actors compromised multiple high-profile Instagram accounts last week by simply asking Meta’s AI-powered account recovery assistant to hand them over.

Products

InstagramThreat actors compromised multiple high-profile Instagram accounts last week by simply asking Meta’s AI-powered account recovery assistant to hand them over.Meta AIIn this case, the Meta AI assistant had API access to account management systems, being deployed to help users re-link email addresses, reset passwords, and verify they are the owners of specific accounts.

Related Articles