NewsPublished 2 Jun 2026

Instagram users locked out after Meta AI abused to steal accounts

Source Bleeping Computer

Description

Multiple Instagram users had their accounts hijacked after attackers convinced Meta's AI-powered support tools that they were the legitimate owners. [...]

Impact

Successful exploitation results in account takeover, including high-value and rare Instagram accounts. Attackers can bypass two-factor authentication and geolocation checks, leading to loss of account control for victims. Victims face significant difficulty recovering accounts due to the lack of human support in the recovery process. The incident undermines trust in AI-based verification and automated support mechanisms.

Defensive guidance

Meta has stated the issue has been resolved and impacted accounts are being secured. No further action is required from users at this time. Users should monitor official Meta communications for updates.

Summary

Attackers abused Instagram's AI-driven account recovery system by using AI-generated animated videos derived from victims' photos to pass facial verification checks. This allowed them to change the email addresses linked to accounts and reset passwords, effectively hijacking accounts despite two-factor authentication protections. The automated support system does not provide a human escalation path, trapping victims in unproductive chatbot loops. Some attackers also used VPNs to mimic victims' geographic locations to bypass additional security checks.

References

bleepingcomputer.com/news/security/instagram-users-locked-out-after-meta-ai-abused-to-steal-accounts/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Jun 2026, 15:48 UTC

References

Community reviews