What has happened?

We reported earlier this year about an increase in fake profiles posting adult spam on Instagram, however in recent months the trend has moved from fake profiles created by scammers to already existing accounts that they have hacked.

Once lured to a hijacked profile by sexually suggestive images, users are encouraged to click a profile link disguised by a shortened URL that leads to the registration page for a site.  The scammers earn money for each user who signs up.

How can I spot a hacked account?

Once hijacked, the hackers upload suggestive photos and change the biography to something equally as suggestive that instructs readers to click the profile link.  You may notice original pictures of the account owner if you scroll down the profile, as the hackers are unlikely to spend time deleting them.

How are the accounts hacked?

We can’t be certain, but we suspect that weak passwords and using the same password repeatedly for different sites is the problem.  So far in 2016 almost 650 million passwords have been leaked through data breaches, so cybercriminals could be finding them from there.

How can I protect myself?

1. Use a strong, unique password like one created by our generator

2. Turn on two factor authentication for Instagram, if available

3. Report any hacked accounts you find to Instagram directly.

Lastly, share this information with anyone you feel could be at risk!