Loading video...

Video Failed to Load

Go Home

Hackers convince Meta AI to send a code to a 'new' email — possibly how the old Obama White House Instagram may have been hijacked The breach also hit high-value IG usernames like 'hey' and 'jowo' — which are worth over $1M combined Meta says the flaw is now fixed

201,101 views • 2 months ago •via X (Twitter)

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

‼️🚨 BREAKING: Meta's AI feature let attackers hijack Instagram accounts for days with nothing but a username. It was being A/B tested on a slice of users, and if you were in the test, you couldn't turn it off. Among the casualties: the official Obama White House account. The method: get on a VPN near the target's region, ask the Meta AI support agent to send a verification code to any email you control, relay that code back to the agent, and it hands over a password reset link. Without ID or human review. From there, the account is yours. The flaw lived in the AI's logic layer, which acted on recovery requests with no real identity checks. One researcher compared it to the Roblox AI assistant exploit from days earlier, where you needed a target's billing info. Instagram was easier: the username and a regional VPN were enough and victims reported sessions revoked and passwords changed with no email, text, or push alert at all. By the time it went public, the method was common knowledge in blackhat Telegram circles and had been used to allegedly hijack 100+ high-value accounts. Accounts hit: - obamawhitehouse (the archived official Obama White House account, ~2.4M followers. Hackers posted an AI-generated image captioned "The White House is under Shiites' control," plus cryptic anti-Trump and pro-Iranian Stories. Meta confirmed the hack and scrubbed it. - Premium short handles like hey and jowo, worth over $1M combined, stolen and flipped on Telegram. - albert (owned by Albert Renshaw), whose owner publicly reported being locked out and unable to reach Meta support. Meta has since patched it. There was no public acknowledgment.

International Cyber Digest

325,374 views • 2 months ago