Hackers stole high-value Instagram accounts by asking Meta's AI support chatbot to reset their passwords. The attack required nothing more than a chat message.
404 Media reported on June 1st that the technique had been passed around on Telegram for days before Meta deployed an emergency patch. Attackers used a VPN to match the target's region, then asked the AI to link a new email address to the target account, and the bot sent a password reset link to the attacker's inbox without verifying ownership. Targets included premium short-handles like @hey and @jowo (allegedly worth over $1M combined), a US Space Force account, and a long-dormant US government account that was briefly defaced. The hackers said their exploit failed against accounts with two-factor authentication. Meta's statement: "We fixed an issue that allowed an external party to request password reset emails for some Instagram users. There was no breach of our systems and people's Instagram accounts remain secure."
Sources:
https://www.404media.co/hackers-simply-asked-meta-ai-to-give-them-access-to-high-profile-instagram-accounts-it-worked/
https://krebsonsecurity.com/2026/06/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts/
https://techcrunch.com/2026/06/01/hackers-hijacked-instagram-accounts-by-tricking-meta-ai-support-chatbot-into-granting-access/
More on cybersecurity, privacy, scams, and homelab on Hake Hardware. New shorts every weekday.
#cybersecurity #instagram #metaai #accounttakeover #ai
404 Media reported on June 1st that the technique had been passed around on Telegram for days before Meta deployed an emergency patch. Attackers used a VPN to match the target's region, then asked the AI to link a new email address to the target account, and the bot sent a password reset link to the attacker's inbox without verifying ownership. Targets included premium short-handles like @hey and @jowo (allegedly worth over $1M combined), a US Space Force account, and a long-dormant US government account that was briefly defaced. The hackers said their exploit failed against accounts with two-factor authentication. Meta's statement: "We fixed an issue that allowed an external party to request password reset emails for some Instagram users. There was no breach of our systems and people's Instagram accounts remain secure."
Sources:
https://www.404media.co/hackers-simply-asked-meta-ai-to-give-them-access-to-high-profile-instagram-accounts-it-worked/
https://krebsonsecurity.com/2026/06/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts/
https://techcrunch.com/2026/06/01/hackers-hijacked-instagram-accounts-by-tricking-meta-ai-support-chatbot-into-granting-access/
More on cybersecurity, privacy, scams, and homelab on Hake Hardware. New shorts every weekday.
#cybersecurity #instagram #metaai #accounttakeover #ai
- Category
- Cybersecurity

Comments