{"id":3430,"date":"2026-06-01T18:03:46","date_gmt":"2026-06-01T18:03:46","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/"},"modified":"2026-06-01T18:03:46","modified_gmt":"2026-06-01T18:03:46","slug":"hackers-used-metas-ai-support-bot-to-seize-instagram-accounts","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/","title":{"rendered":"Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts"},"content":{"rendered":"<div>\n<p>The <strong>Instagram<\/strong> accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta\u2019s \u201cAI support assistant\u201d bot into resetting account passwords.<\/p>\n<div id=\"attachment_73755\" style=\"width: 721px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" aria-describedby=\"caption-attachment-73755\" decoding=\"async\" class=\" wp-image-73755\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/metasupportbot.png\" alt=\"\" width=\"711\" height=\"650\"><\/p>\n<p id=\"caption-attachment-73755\" class=\"wp-caption-text\">A screenshot from a video released on Telegram claiming to show how Meta\u2019s AI customer support bot could be tricked into resetting a target\u2019s password.<\/p>\n<\/div>\n<p>On May 31, word began to spread on several Telegram instant message channels that Meta\u2019s AI bot would happily add an email address to an existing account as part of the bot\u2019s standard password reset flow.<\/p>\n<p>A video released on Telegram by pro-Iran hackers claimed to document a remarkably simple exploit that appears to have involved using a VPN connection with an IP address that is in or near the target\u2019s usual hometown, requesting a password reset for the account, and then choosing to chat with Meta\u2019s AI support assistant. From there, the video shows the attacker told the bot to link the account in question to a new email address, after which the bot dutifully sent that address a one-time code that allowed a password reset.<\/p>\n<p>The Telegram account that posted the video also linked to screenshots of pro-Iran images, videos and messages that defaced the hacked Instagram accounts, saying hackers had used the exploit to hijack a number of valuable (read: short) Instagram account names that allegedly have a resale value of more than a half million dollars.<\/p>\n<p>Meta has not responded to requests for comment on the video\u2019s claims, but the company reportedly did acknowledge the dormant Instagram account for the Obama White House was briefly compromised. The security blog thecybersecguru.com <a href=\"https:\/\/thecybersecguru.com\/news\/instagram-meta-ai-vulnerability-account-recovery-exploit\/\" target=\"_blank\" rel=\"noopener\">reports<\/a> that Meta pushed an emergency patch over the weekend, and clarified that no back end database was breached.<span id=\"more-73751\"><\/span><\/p>\n<p>\u201cInstagram has notoriously poor human support infrastructure,\u201d Cybersecguru wrote. \u201cRecovering a locked account \u2013 especially a high-value one can take weeks of back-and-forth with an automated ticketing system. Meta\u2019s solution was to deploy a conversational AI layer to handle common recovery workflows: relinking a lost email address, triggering a password reset, verifying account ownership. The assistant, presumably, was supposed to reduce friction for legitimate users stuck in account-access hell.\u201d<\/p>\n<p><strong>Ian Goldin<\/strong>, a threat researcher at Lumen\u2019s <strong>Black Lotus Labs<\/strong>, said we\u2019re entering unchartered security territory as more large online platforms start allowing AI chatbots to handle sensitive account recovery requests. Just like human customer support employees can be social engineered into providing unauthorized access to someone\u2019s account, AI bots are equally eager to help and vulnerable to persuasion and trickery, he said.<\/p>\n<p>\u201cAI chatbots create interesting new attack surface, and we\u2019re likely going to see a lot more of these kinds of attacks,\u201d Goldin said.<\/p>\n<p>Securing your various online accounts means taking full advantage of the most secure form of multi-factor authentication (MFA) offered (such as a passkey or security key). In this case, even using the least robust form of MFA that Instagram offers \u2014 a one-time code sent via SMS \u2014 likely would have blocked the exploit: The hackers who released the video on Telegram said their exploit failed to work against any accounts that had MFA enabled.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta\u2019s \u201cAI support assistant\u201d bot into resetting account passwords. A screenshot from a video released on [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[113,965,90,1231,439,143,345,176,145],"tags":[91],"class_list":["post-3430","post","type-post","status-publish","format-standard","hentry","category-a-little-sunshine","category-black-lotus-labs","category-cybersecurity","category-ian-goldin","category-instagram","category-latest-warnings","category-meta","category-the-coming-storm","category-web-fraud-2-0","tag-cybersecurity"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta\u2019s \u201cAI support assistant\u201d bot into resetting account passwords. A screenshot from a video released on [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-01T18:03:46+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts\",\"datePublished\":\"2026-06-01T18:03:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/\"},\"wordCount\":558,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/metasupportbot.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"A Little Sunshine\",\"Black Lotus Labs\",\"Cybersecurity\",\"Ian Goldin\",\"Instagram\",\"Latest Warnings\",\"meta\",\"The Coming Storm\",\"Web Fraud 2.0\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/\",\"name\":\"Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/metasupportbot.png\",\"datePublished\":\"2026-06-01T18:03:46+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#primaryimage\",\"url\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/metasupportbot.png\",\"contentUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/metasupportbot.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/","og_locale":"en_US","og_type":"article","og_title":"Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts - Imperative Business Ventures Limited","og_description":"The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta\u2019s \u201cAI support assistant\u201d bot into resetting account passwords. A screenshot from a video released on [&hellip;]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-06-01T18:03:46+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts","datePublished":"2026-06-01T18:03:46+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/"},"wordCount":558,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/metasupportbot.png","keywords":["Cybersecurity"],"articleSection":["A Little Sunshine","Black Lotus Labs","Cybersecurity","Ian Goldin","Instagram","Latest Warnings","meta","The Coming Storm","Web Fraud 2.0"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/","name":"Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/metasupportbot.png","datePublished":"2026-06-01T18:03:46+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#primaryimage","url":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/metasupportbot.png","contentUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/metasupportbot.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/01\/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Hackers Used Meta\u2019s AI Support Bot to Seize Instagram Accounts"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=3430"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3430\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=3430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=3430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=3430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}