Recently, attackers took over high-profile Instagram accounts, including the official Obama’s White House account and a United States Space Force chief officer. The attacker didn't break any Instagram code or crack passwords. They convinced Meta's own AI support chatbot to hand over the accounts. Meta uses an AI-powered support chatbot to help users recover locked accounts, change recovery emails, and handle account issues. The chatbot is trained to verify identity through questions and decide whether a request looks legitimate. Attackers figured out how to manipulate that decision making process. Video Credit- x.com/chetaslua The attack consists of four main steps. Step 1: The attacker contacts Meta's AI support chatbot claiming to be the legitimate owner of a target account. They simply use Instagram's help interface and start an account recovery conversation. For high-profile targets, attackers use publicly available information such as display names, profile bios, ...
I am a technology writer with a focus on cybersecurity. I cover topics such as malware, vulnerabilities, exploits, and security defenses, as well as research and innovation in information security.