[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu8W7NXcmemefOioJFEWQJCCT11aMAXsqSysZQ44haQ0":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"c1080b9c-6ade-49b0-a615-b6fbef79faa4","Hackers Abused Meta’s AI Support Bot to Hijack Major Instagram Accounts","hackers-abused-meta-s-ai-support-bot-to-hijack-major-instagram-accounts-e90702","Hackers abused Meta’s AI support bot to hijack major Instagram accounts, bypassing security checks as videos showed the flaw before Meta fixed the issue.","Hackers exploited a critical logic flaw in Meta's AI support assistant to hijack major Instagram accounts over a weekend in June 2026, bypassing two-factor authentication and identity verification using AI-generated deepfake videos. Affected accounts included beauty brand Sephora, US Space Force official John Bentivegna, security researcher Jane Wong, and the archived Barack Obama White House account with 2+ million followers. Meta patched the vulnerability after videos demonstrating the exploit went viral in blackhat Telegram groups, though valuable handles worth ~$1M were reportedly stolen and sold.","Hackers exploited logic flaw in Meta's AI support bot to hijack Instagram accounts including Sephora and Obama White","https:\u002F\u002Fhackread.com\u002Fhackers-abuse-meta-ai-bot-hijack-instagram-accounts\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FInstagram-hacked.mp4","2026-06-02T14:58:17+00:00","2026-06-02T16:00:09.0409+00:00",9,[17,20,23,25],{"name":18,"type":19},"Meta","vendor",{"name":21,"type":22},"Meta AI support assistant","product",{"name":24,"type":22},"Instagram",{"name":26,"type":27},"Two-factor authentication","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[50],{"type":51,"value":52,"context":53},"malware","AI-generated deepfake video","Fake selfie videos created with AI tools used to bypass Meta's identity verification checks during account hijacking",[18,21,24],{"controls":56,"vendors":134},[57,86,112],{"slug":58,"name":59,"problem":60,"products":61},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":87,"name":88,"problem":89,"products":90},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[91,96,104],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":92,"product_name":93,"url":94,"description":95},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":48,"name":113,"problem":114,"products":115},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[116,121,129],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":117,"product_name":118,"url":119,"description":120},"ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":130,"product_name":131,"url":132,"description":133},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"ai-support-system-exploited-to-bypass-account-security-controls","AI Support System Exploited to Bypass Account Security Controls","Hackers discovered and exploited a critical logic flaw in Meta's AI support assistant that allowed them to bypass multi-factor authentication and hijack high-value Instagram accounts. The attackers used AI-generated deepfake videos to fool identity verification processes, demonstrating how AI systems can introduce new attack vectors when not properly secured. This incident highlights the critical importance of thorough security testing for AI-powered customer support tools and robust account recovery processes that can't be easily manipulated through social engineering or deepfake technology.",[140,141,142,143,144],"CIS Control 11","NIST IA-4","NIST AC-2","NIST SI-10","ISO 27001 A.9.2.6",{}]