Hackers Hijack Instagram Accounts Through Meta’s AI Flaw

Meta’s AI-powered Instagram support bot was exploited by hackers, allowing them to hijack accounts—including Barack Obama’s White House account, Sephora, and U.S. Space Force officials—simply by asking the bot to change recovery details. Meta has patched the flaw, but the incident highlights serious risks in using AI for sensitive security functions.

Meta launched its AI-powered Instagram Support Bot in December 2025, with a global rollout expanding in March 2026. It was designed to provide 24/7 account help, including password resets, scam reporting, and privacy management, but was later exploited by hackers due to weak safeguards.

The Instagram Support Bot was meant to simplify account recovery, but its exploitation shows how AI-driven customer support can become an attack surface if not properly safeguarded.

What Happened

• Exploit Method: Hackers tricked Meta’s AI support chatbot into linking a target Instagram account to a new attacker-controlled email.
• Password Reset: Once linked, the bot facilitated a password reset, locking out the legitimate owner.
• Bypassing Safeguards: Attackers used VPNs to spoof locations and bypass fraud detection.
• No Alerts: Victims did not receive SMS, push notifications, or warning emails during the takeover.

High-Profile Accounts Compromised

Account	Impact
Obama-era White House Instagram (@obamawhitehouse)	Defaced with politically inflammatory content
Sephora (official account)	Hijacked and disrupted
U.S. Space Force Chief Master Sergeant John Bentivegna	Personal account compromised
Rare “OG” handles (@hey, @jowo)	Valued at over $1M in underground markets

Why It Matters

• AI Security Risks: The bot had backend privileges but lacked identity verification safeguards.
• Prompt Injection Vulnerability: Attackers exploited natural language prompts to override intended security checks.
• Broader Trend: Similar AI manipulation attacks have occurred elsewhere (e.g., dealership chatbots offering cars for $1).

Meta’s Response

• Patch Released: Meta confirmed the vulnerability was fixed on June 1, 2026.
• Account Recovery: Impacted accounts are being secured, though Meta has not disclosed the total number affected.
• Future Safeguards: Renewed scrutiny over reliance on AI for account recovery and password management.

What Users Should Do

• Enable Two-Factor Authentication (2FA): Still critical for other attack vectors.
• Check Recovery Settings: Verify your email and phone number linked to Instagram.
• Monitor for Alerts: Watch for suspicious login attempts or password reset notifications.
• Report Issues: Use Meta’s official support channels immediately if you suspect compromise.

Key Takeaway

This breach shows that AI-driven customer support systems can become attack surfaces if not properly safeguarded. Meta’s incident is a cautionary tale for all platforms deploying AI in sensitive security workflows.

120,000 Home Cameras Breached: Privacy at Risk in the Digital Age

South Korean police revealed that over 120,000 internet-connected home cameras were hacked, with footage exploited to create and sell sexually explicit videos. Four suspects have been arrested in connection with the scheme.

National Police Agency (NPA) of South Korea has issued an official statement confirming the arrests of four suspects who hacked approximately 120,000 home and business IP cameras to produce and sell sexually exploitative material.

About 120,000 IP cameras (often called “home cams”) installed in private homes, karaoke rooms, Pilates studios, and clinics were compromised.

Four individuals were arrested. Importantly, police clarified that they acted independently and were not accomplices. The suspects created and sold hundreds of sexual abuse videos on overseas websites. Police noted they are working with overseas agencies to track website operators and buyers involved in distributing the material.

The NPA highlighted that weak passwords and poor security settings on IP cameras were the main vulnerabilities exploited. The case is being treated under South Korea’s strict digital sex crime laws, which have been strengthened in recent years after similar scandals. Authorities urged citizens to immediately change default passwords and update firmware to prevent further breaches.  

---

Key details of the case

• Scale of the breach: More than 120,000 surveillance cameras in homes and businesses across South Korea were compromised.
• Targets: Cameras were placed in private homes, karaoke rooms, Pilates studios, and clinics, making the intrusion deeply invasive.
• Suspects: Police charged four individuals. One suspect alone hacked 63,000 cameras and produced 545 exploitative videos, earning about 35 million won (~₹21 lakh) from sales.
• Method: Hackers exploited weak security in IP cameras, such as default or easy-to-guess passwords.
• Content: The stolen footage was turned into sexually exploitative material and distributed online.

---

Broader implications

• Privacy crisis: This case highlights how vulnerable consumer-grade surveillance devices can be when users fail to change default settings or manufacturers neglect strong security protocols.
• Legal crackdown: South Korea has strict laws against digital sex crimes, and this incident is expected to intensify calls for tougher regulation of surveillance technology.
• Global warning: Similar risks exist worldwide. Any internet-connected device with a camera or microphone can be hijacked if not properly secured.

---

How to protect yourself

• Change default passwords immediately on all smart devices.
• Enable two-factor authentication where possible.
• Update firmware regularly to patch vulnerabilities.
• Avoid cheap, unverified brands that may lack proper security safeguards.
• Use encrypted networks and avoid exposing devices directly to the internet.

---

This incident is a stark reminder that digital safety is inseparable from physical privacy. The exploitation of everyday devices for sexual crimes shows how technology can be weaponized when security is neglected.

Ethereum Inventor Vitalik Buterin’s X (Twitter) Account Hacked Leading $691K+ Losses from Victims' Accounts

Vitalik Buterin, Ethereum’s inventor & co-founder, reportedly had his X (formerly Twitter) account hacked, resulting into loss of $691,000 from users who followed a malicious link posted to his X feed.

According to prominent blockchain investigator ZachXBT, the hacking incident has led to victims collectively losing over $691,000 after clicking on a corrupted link.

Dmitry Buterin, the father of Vitalik, announced on Sep. 9 in a post at X that his son’s account had been compromised and Vitalik is working on restoring access.

The account hack was first noticed on Saturday when a post appeared on Buterin’s post announcing the launch of a set of commemorative non-fungible tokens (NFTs) from software provider Consensys.

This post has a malicious link, which could have been displayed to a large number of Vitalik's 4.9 million followers, and prompted followers to follow the link and eventually connect their wallets to mint the NFT, but in reality, it allowed the hacker(s) to get access to their funds in their wallets.

The post on Vitalik's account was later deleted. However, the damage was done already.

This incident has even led Ethereum developer Bok Khoo, better known as Bokky Poobah on X, to allegedly suffered losses in his CryptoPunk NFT collection.

Notably, no official comment has been made by Vitalik, so far, in this hacking incident. According to ZachZPT, the hacker subsequently sent a stolen NFT to Vitalik.

they hacker just sent Vitalik this NFT they drained

0x909c74236ded54ecea95ea1568e1abf67624ccae436d1b9d94cd0c163b11eec5 pic.twitter.com/Fx6ekDYyWR

— ZachXBT (@zachxbt) September 10, 2023

Meet 'Shodan' - The Scariest Search (Hacker) Engine On Internet

Bored of your Google search engine? Wanna try something new?Try Shodan, the search engine, the next time you want to search something over the net and you will surely be never be bored again ever in your entire life.

Websites are just one part of the Internet. There are power plants, Smart TVs, refrigerators and much more that can be found with Shodan!

Launched in 2009, this particular search engine has earned the reputation of being called as the scariest search engine on Internet. Named after the villainous computer in the video game System Shock, the search engine is not just like another simple search engine. It's more of a prying eye across the world through the Internet of Things (IoT).

The hacker search engine, as Shodan is commonly called, is the works of the wonder minds of John Matherly. He designed it with an aim of linking all the devices connected to the Internet but fortunately, unfortunately, it became a play zone for hackers and experimenters in no time.

The search engine works by collecting and stacking HTTP addresses from various devices linked over the Internet across the world. The indexing is then done on the basis of categories such as brand, OS and country.

The search engine has excellent scanning powers. So much so that, it can even detect security cameras, power grids, control systems for gas stations, and even the nuclear power plants. These public services need to make extra efforts in increasing their online security as once exposed to hackers or terrorist organizations, the results could be very disastrous.

Further, if you have a telnet enabled security camera at your home for the "security" of your family, you might just want to put that camera to rest. Hackers can easily breach into your system if your IoT hub is exposed on the Internet using Shodan. So, for the security of your family, we recommend you to put that security camera right away and think of something else.

Shodan Portal - www.shodan.io

[Top Image - Shutterstock]

Meet 'Shodan' - The Scariest Search (Hacker) Engine On Internet

Bored of your Google search engine? Wanna try something new?Try Shodan, the search engine, the next time you want to search something over the net and you will surely be never be bored again ever in your entire life.

Websites are just one part of the Internet. There are power plants, Smart TVs, refrigerators and much more that can be found with Shodan!

Launched in 2009, this particular search engine has earned the reputation of being called as the scariest search engine on Internet. Named after the villainous computer in the video game System Shock, the search engine is not just like another simple search engine. It's more of a prying eye across the world through the Internet of Things (IoT).

The hacker search engine, as Shodan is commonly called, is the works of the wonder minds of John Matherly. He designed it with an aim of linking all the devices connected to the Internet but fortunately, unfortunately, it became a play zone for hackers and experimenters in no time.

The search engine works by collecting and stacking HTTP addresses from various devices linked over the Internet across the world. The indexing is then done on the basis of categories such as brand, OS and country.

The search engine has excellent scanning powers. So much so that, it can even detect security cameras, power grids, control systems for gas stations, and even the nuclear power plants. These public services need to make extra efforts in increasing their online security as once exposed to hackers or terrorist organizations, the results could be very disastrous.

Further, if you have a telnet enabled security camera at your home for the "security" of your family, you might just want to put that camera to rest. Hackers can easily breach into your system if your IoT hub is exposed on the Internet using Shodan. So, for the security of your family, we recommend you to put that security camera right away and think of something else.

Shodan Portal - www.shodan.io

[Top Image - Shutterstock]

Largest Hacking - 1.5 million MasterCard and Visa Card Numbers Stolen

In one of the largest hacking scam in US history the US government has accused five men from Russia and the Ukraine of masterminding one of the largest hacking scheme where hackers stole credit card numbers belonging 1.5 million customers of world’s two largest credit card processors - MasterCard and Visa and other as well and stealing more than $300 million from at least three of the companies they attacked. Two of the mastermind hacker men are in police custody, while three others are on the loose and considered fugitives.

Today the international credit card processor was blocked by Visa after it reported the possibility of a major security breach as reported by Wall Street Journal. The hackers from Russia and Ukraine reportedly hacked NASDAQ, Visa, J.C. Penney, 7-Eleven and JetBlue, among other companies from last 7 years almost i.e. from 2005 till early last year.

The two largest credit card processors MasterCard and Visa didn't reveal what allowed hackers to gain access into the system however they reportedly told that it was result of a third-party vendor and not their own internal systems. The affected Visa and MasterCard customers have not yet been notified that their account information was stolen.

The Wall Street Journal reports that customers' names, addresses and Social Security numbers were not compromised, the credit card numbers were only downloaded during the attack and didn't succeed in gaining more information using the card numbers.

[Image - Flickr, Joel Richards]

Facebook Gave $20,000 Award for Finding SMS Bug

Facebook has recently awarded a british security researcher amount of $20,000 for discovering a bug which will lead to a full takeover of any Facebook account, with no user interaction. Facebook has now acknowledged and responded to this bug and fixed the flaw within a day.

Its actually SMS feature provided by Facebook to receive updates via SMS.  This feature gives users the option of linking mobile number with FB account and also allows login using the mobile number rather the usual email address. Jack Whitton aged 22, a UK based Security Researcher found this serious loophole and the award of $22,000 tells the severity of the bug.

Facebook also listed Jack in its Hall of Fame, for finding this bug, anyone who find any security loophole can report facebook for fix and who knows might get awarded for same. Facebook runs this White Hat program to collaborate with external security researchers and help Facebook to ensure that highest security standards are being maintained for users.

Jack explained the bug in his blog, to exploit this bug, he first send the letter F to 32665, which is Facebook’s SMS short-code in the UK and received an 8 character verification code back, entered this code into the activation box modified the HTML values inside source code of 'Facebook Mobile' activation page, submit it to get user data via ajax (from facebook only), reset the user password to finally hack the account.

Facebook encouraged security researchers or even 'white-hat' hackers to report security flaws, bugs to Facebook Security team and get awarded provided you are the first one to report, rather than booking it as cyber-crime. The minimum award is $500 USD and no-maximum and as per facebook - depends on its severity and creativity.

According to Facebook - "..visit the Facebook Security Page for assistance. If you believe you have found a security vulnerability on Facebook, we encourage you to let us know right away. We will investigate all legitimate reports and do our best to quickly fix the problem."

This is something that is missing out in philosophy of Internet giants in India,recently this month only India's biggest gaming website's Zapak.com has been hacked. Although, no company can ensure 100% prevention of bugs but like Facebook, can minimize the risks of loss of information and hacks.

The incidences are common across the globe however, but the encouragement toward reporting incidence is not uniform across the globe, the same is not for just monetary awards and bounty but it act as a competitive behaviour in core-programmers/developers of apps and more carefulness. This also bring out sense of working out of the fences within core-programmers and part-time work opportunity for freelance programmers & collaboration with security researchers.

Facebook knows that what its employees can do is good but what extra it can get outside facebook office boundaries is vast and outside talents will do no harm but will give an extra edge to be stronger, this something to be learned from young company like Facebook.

India Biggest Gaming Website Zapak.com Hacked

Zapak.com, India's biggest gaming website's mobile version has been hacked by ZHC (ZCompany Hacking Crew) aka TeaMp0isoN is a group of computer hackers. The mobile website of Zapak.com - m.zapak.com shown with messages such as - 'Hacked by ZHC Milan Mil', 'free Kasmir', 'Go India Go Back' etc.

This group of hackers active since year 2008 are same ones who were involved in very high-profile hacking incidents in the past such as - hacking and unauthorized status updates of Mark Zuckerberg and French President Nicolas Sarkozy's accounts on facebook in 2011 and also involved in Tony Blair address book leak, hack of NASA administered domain, released more than 100 usernames and login details of United Nations Development Programme (UNDP) etc. and many more.

No official announcement has been made from Zapak.com as yet and the mobile website is still not accessible and show hacked page only.

The leader of the hacking groups is so called, 26 year old - 'Don' and it is said that unlike to most of the hacking groups like Zeus malware group, ZHC do not use any tools or softwares they exploit servers day-by-day and intrude the websites via loopholes such as - errors or or bugs that exist already in the websites.

Via - AalaW