The most important thing in the face of a cyberattack is to stay calm and not make rash decisions – a stolen account can be recovered. ESET experts analyze a case of Instagram profile theft and share advice on how to protect your profile from potential attacks by cybercriminals.

Loss of access to the profile

ESET cybersecurity experts recently analyzed a case of an Instagram account being hacked. The consequence of the hackers' actions was a complete loss of access to the profile. The cybercriminals not only changed the password but also enabled two-factor authentication during login, setting a foreign phone number and email address to which only they had access. They also added random digits to the username, which were probably meant to make it harder to recover access to the account via phone. They then tried to take over accounts from the friends list by sending them messages impersonating the victim, who was supposedly asking for help in recovering a blocked account. How could cybercriminals have taken over an Instagram user's account?

– The first mistake that could have led to this situation was setting too simple a password, which the victim also used on other portals. The password could have leaked from another service, been phished by attackers, or even guessed – says Kamil Sadkowski, senior cybersecurity specialist at ESET. – The second mistake was the lack of two-step verification, which is free and simple to use in social media and email services. If this feature had been enabled, then even if the attackers had the correct password for the Instagram account and the email account, thanks to which they are able to use the method popular among criminals known as 'forgotten password,' they would still have hit a proverbial wall. The fact that after taking over the account they themselves enabled two-factor authentication clearly shows that criminals are aware of the effectiveness of this safeguard – he adds.

The road to recovering the account is not short

 

The victim tried to recover the account by following the advice suggested by Instagram. Unfortunately, she could not receive the message with the data to change the password, which would have allowed her to regain access to the profile. As it turned out, in the email account settings, the hackers had blocked incoming emails from Instagram's technical support department. After unblocking the sender and receiving the message with the password reset link, the victim of the attack had to verify her identity by sending a selfie video. However, this was only possible because she had previously posted her photos on her profile. Thanks to this, Instagram's technical support was able to carry out the verification. After about 20 minutes, the profile owner received a code that allowed her to log in to the account again. Although the code worked and she managed to log in, unfortunately access to the account was immediately cut off. Repeating the whole process produced the same result. During this time, the user began receiving suspicious emails impersonating Instagram technical support asking for verification data, which she ignored.

Subsequent attempts to regain access to the account were made from the experts' computer. A message emailed by the rightful owner of the Instagram account with a verification link allowed the experts to successfully log in to the profile. The next step was to secure the account by disabling the two-factor authentication enabled by the hackers. The foreign phone number provided by the criminals was changed to the owner's phone number. After restoring the correct username, the password was changed and two-factor authentication via SMS was enabled.

Account recovered – what next?

After recovering and securing the account, the user could finally manage it again and correct all the messages that the hackers sent while impersonating her. It turned out that all the friends who suspected that the messages did not actually come from the victim of the attack, or who tagged her in stories, had been blocked by the cybercriminals.

- Using a unique, strong password and enabling multi-factor authentication right after creating an account is a practice that effectively reduces the likelihood of losing access to a service as a result of an attack – advises the ESET expert.

How to recover an Instagram account step by step

  • Go to your email account and make sure no email addresses from Instagram are on the blocked list.
  • Visit the password reset page on Instagram.
  • Follow the instructions displayed on the page and submit a request to verify your identity. For this purpose, you will be asked to record a video. This is only possible if the account already contains your photos. The recovery link will be sent to the original email address.
  • If that doesn't work, try again until you are verified.
  • After successfully completing the verification process, you will receive an eight-digit code, which will be required after clicking the link sent from Instagram.
  • Log in to the account on a computer, preferably using an IP address that has not been used before to access the account.
  • Once you're in, immediately invalidate the fake two-factor authentication set by the cybercriminals.
  • Change the password to a strong, unique one that is not thematically related to you.
  • Change the phone number back to your own.
  • Re-enable two-factor authentication.
  • Consider the option of two-factor authentication based on an app rather than SMS.
  • Change the username back on the laptop before re-entering it on the phone.
  • Finally, check the list of blocked people on your Instagram account. The hackers may have placed your close friends there.

ESET expert tips on how to prevent account loss

 

  • Use a strong and unique password on Instagram.
  • Enable two-factor authentication on your Instagram account, email, and other services.
  • Watch out for phishing messages supposedly coming from Instagram.
  • Be wary of any messages on Instagram that begin, for example: “Hi, I need your help.” If you receive such a message from a friend, call the account owner to make them aware that their account has probably fallen victim to an attack.
  • Have at least one photo of your face on your account so that the process of possibly recovering the account using a selfie video can work properly.