Hackers took over Instagram accounts by asking Meta AI new password

Hackers were able to take over the Instagram accounts of many users in recent months by requesting a new password from Meta AI. Meta says it managed the attack via the AI ​​chatbot.

The attack worked by setting up a VPN from the user's region and then requesting help from the AI ​​chatbot that Meta uses to help users on Instagram via forgotten password. The attackers then asked to change the email address of the account, 404 Media reports.

This works because Meta has set the chatbot in such a way that it can actively help with problems, such as no longer having access to the account. After the attackers transferred the email, they started resetting the password, a process that takes place via the email address. They then gained access to the account.

The attackers mainly targeted accounts with attractive usernames of one, two, three or four characters. They could then sell that access. Meta says it has fixed the vulnerability, although it is unclear how exactly that was fixed.