Security on social media has once again been called into question after it was discovered that the AI-powered support assistant Meta's system has served as a gateway for cybercriminals. What was initially designed to facilitate the recovery of locked profiles ended up becoming a sieve that has allowed unauthorized access to thousands of users. This incident highlights the risks of delegating critical identity functions to automated systems that, at times, are guilty of being overly accommodating to those they shouldn't be.
The chaos has erupted mainly on Instagram, where a group of attackers managed to bypass the usual protocols simply by chatting with the platform's chatbot. The magnitude of the problem is such that It is estimated that more than 20.000 people They could have lost control of their profiles due to this technical vulnerability. Although the company claims to have already addressed the issue, the trail left by the hackers demonstrates a worrying ease with which they were able to manipulate the logic of a tool designed to protect us.
The trick to fooling Meta's virtual assistant
The method used by the attackers did not require extensive programming knowledge, but rather an understanding of the system's vulnerabilities. According to technical reports, Virtual private networks or VPNs were used to simulate that the connection was being made from the same city as the legitimate account owner. This way, Meta's system lowered its guard, considering the help request geographically consistent and allowing the recovery process to proceed without suspecting that it was an imposter.
Once the connection was established, the attacker instructed the AI ​​assistant to change the email address associated with the account to a new one under their control. The major security flaw lay in the fact that The bot did not perform rigorous verification If the new email address truly belonged to the user, the system would simply send a confirmation code to the address provided by the hacker. Upon entering this code in the chat, the system would validate the user's identity and offer a direct button to reset the password, effectively locking the original owner out.
This situation has made it clear that the obsession with eliminating friction in customer support can be very costly. By fully automating the tool called High Touch SupportMeta eliminated the human element that previously acted as a filter for suspicious requests. For weeks, criminals were able to operate with impunity, requesting bulk changes of credentials, which has led to a wave of digital kidnappings coordinated even through private messaging channels like Telegram.
The technique was so effective that even accounts with additional security measures faltered if their protocols weren't properly configured. Many users have complained that The system ignored multi-factor authentication. At certain stages of the process, users blindly trusted email validation that had just been fraudulently altered. This serves as a reminder that, in the digital world, any weak link in the recovery chain can undo years of precautions taken by the internet user.
Impact on institutional and high-value profiles
It's not just ordinary users who have been alarmed, as the breach has affected profiles of great global importance. Among those affected are... During the Obama era, accounts suddenly began displaying strange content and messages unrelated to their original purpose. Even well-known brands like Sephora and profiles linked to high-ranking members of the U.S. Space Force have seen their feeds flooded with unauthorized posts after falling victim to this automated scam.
The attackers' interest in these types of accounts is not accidental, since profiles with many followers or coveted usernames have a high value on the black market. It has been detected that They were quickly put up for sale on the dark web, with those seeking to profit before Meta could react and restore access to its rightful owners. The reputational damage to these institutions and companies is evident, especially when the intrusion is due to an internal flaw in the platform itself.
Cybersecurity experts have pointed out that this incident served as a field experiment for criminals. By gaining access to the system, they were able to gain access to the system. They demonstrated that you don't need to break complex encryption to access an account if you can convince the gatekeeper to let you in. The ease with which video tutorials on how to carry out this attack spread on specialized forums exponentially increased the number of victims in just a few days.
Even renowned security researchers were caught up in this mess, suffering sudden session shutdowns and massive password change attempts that even the usual alerts couldn't stop in time. The feeling of Reasons has been one of the most repeated complaints by those who tried to recover their profiles through official channels while seeing how their personal data was exposed to strangers with bad intentions.
Containment measures and the future of automated support
Faced with a barrage of criticism and the data presented to the relevant authorities, Meta has decided to take drastic measures. The company has temporarily disabled the function The company has disabled the help section that allowed these changes and invalidated the recovery links that were suspiciously generated while the vulnerability was active. According to company spokespeople, they are working on a patch that will force the system to verify that the requested email address already exists in the account database.
For those who haven't yet experienced problems, the recommendation is clearer than ever: activate two-step authentication using third-party applications. Relying solely on the code received via SMS or email may not be enough if an attacker gains access. through social engineering or technical glitches like the one we're discussing. Performing a security check from Instagram's settings takes no more than five minutes and can save you considerable trouble.
In addition, the tech company is sending notifications to those affected so they can reset their credentials and check for unauthorized access from unknown locations. Special emphasis has been placed on Since hackers often leave a session open in the background to regain access even if the password is changed, cleaning the list of authorized devices is now a priority for anyone who suspects their profile may have been targeted during this crazy weekend.
Looking ahead, this event opens a necessary debate about the limits of automation in critical services. While it is true that It cannot completely replace human judgment when it comes to managing the digital identity of millions of people. Meta will have to rethink how it trains its assistants so that, in addition to being helpful and polite, they are able to detect when someone is trying to fool them with a VPN and a couple of well-structured sentences.
Everything that has happened serves as a humbling experience for an industry that sometimes runs faster than it can handle in terms of security. The figure of more than 20.000 profiles at risk is a serious warning that They must be as robust as the passwords they protect. From now on, there will be much greater scrutiny of how we interact with support bots, and we're likely to see significantly more rigorous verification processes to ensure that every Instagram account remains in the right hands.