Hackers Abused Meta’s AI Support Bot to Hijack Major Instagram Accounts
Hackers exploited logic flaw in Meta's AI support bot to hijack Instagram accounts including Sephora and Obama White
Hackers exploited a critical logic flaw in Meta's AI support assistant to hijack major Instagram accounts over a weekend in June 2026, bypassing two-factor authentication and identity verification using AI-generated deepfake videos. Affected accounts included beauty brand Sephora, US Space Force official John Bentivegna, security researcher Jane Wong, and the archived Barack Obama White House account with 2+ million followers. Meta patched the vulnerability after videos demonstrating the exploit went viral in blackhat Telegram groups, though valuable handles worth ~$1M were reportedly stolen and sold.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Meta?
Get an email when a new story names Meta, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonHackers discovered and exploited a critical logic flaw in Meta's AI support assistant that allowed them to bypass multi-factor authentication and hijack high-value Instagram accounts. The attackers used AI-generated deepfake videos to fool identity verification processes, demonstrating how AI systems can introduce new attack vectors when not properly secured. This incident highlights the critical importance of thorough security testing for AI-powered customer support tools and robust account recovery processes that can't be easily manipulated through social engineering or deepfake technology.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — AI-generated deepfake video