Security researchers say a Turkish-speaking group of cybercriminals is using an Instagram hack to dupe social media influencers into handing over money and even nude photographs as part of a digital extortion campaign.

According to Trend Micro, the attack begins with a simple phishing email that prompts users who have a large following on the Facebook-owned photo-sharing service to obtain a verification badge for their account profile. A “verified” badge is designed to help distinguish a well-known person’s account from potential fakes or other users with a similar name.

How the Instagram Hack Works

The phishing message prompts users to enter their login credentials, email and date of birth, among other information. After submitting the form, victims are shown a verification badge for a few seconds and then directed back to Instagram. Behind the scenes, the researchers observed the attackers switching the names of profiles, defacing profile pictures and flooding inboxes with security alerts.

In some cases, the attackers proceeded to add and then remove fake followers to a stolen account, as well as some possibly legitimate ones. Some victims were prompted to produce nude photos and videos as well as monetary payment in exchange for access to their accounts. If they failed to do so, the attackers threatened to hold the accounts hostage permanently or even delete them entirely.

An investigation into the attack discovered the words “account” and “eternal” written in Turkish on one of the victim’s profiles. This led to an online forum where other cybercriminals were discussing ways to steal accounts and prevent them from being recovered.

The Big Picture on Social Media Security

Users should be aware that Instagram wouldn’t ask for their login credentials as part of the process of receiving a “verified” badge, but it’s still easy to fall for phishing schemes when the domain names or landing pages look like the real thing. IBM experts suggest using ahead-of-threat detection to identify malicious URLs, scan images for hidden code and more before the actual threat becomes visible.

More from

Tequila OS 2.0: The first forensic Linux distribution in Latin America

3 min read - Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America.IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed by Europe with 28%, North America with 25% and the Middle East with 4%. In the Latin American region, Brazil had 67% of incidents that X-Force…

Cost of a data breach 2023: Geographical breakdowns

4 min read - Data breaches can occur anywhere in the world, but they are historically more common in specific countries. Typically, countries with high internet usage and digital services are more prone to data breaches. To that end, IBM’s Cost of a Data Breach Report 2023 looked at 553 organizations of various sizes across 16 countries and geographic regions, and 17 industries. In the report, the top five costs of a data breach by country or region (measured in USD millions) for 2023…

The Growing Risks of Shadow IT and SaaS Sprawl

4 min read - In today's fast-paced digital landscape, there is no shortage of apps and Software-as-a-Service (SaaS) solutions tailored to meet the diverse needs of businesses across different industries. This incredible array of options has revolutionized how we work, providing cost-effective and user-friendly tools that streamline tasks and boost productivity. However, this ever-expanding application ecosystem comes with its challenges: namely, shadow IT and SaaS sprawl. According to a recent study by Entrust, 77% of IT professionals are concerned about shadow IT becoming a…

Are you ready to build your organization’s digital trust?

4 min read - As organizations continue their digital transformation journey, they need to be able to trust that their digital assets are secure. That’s not easy in today’s environment, as the numbers and sophistication of cyberattacks increase and organizations face challenges from remote work and insider behavior. Digital trust can make your organization’s digital transformation stronger. A lack of digital trust can do irreparable harm. However, according to ISACA’s State of Digital Trust 2023 report, too many organizations struggle to define and implement…