6

My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account.

We have the full phone number and email address the hacker is using to change the info to. The country code has the number origin to Nigeria.

We've contacted Instagram 3 times now by sending a video of her proving her identity. Everytime Instagram has unlocked the account for her.

These are the things she's done everytime she's gotten back into the account, but the hacker has somehow regained access, including by somehow bypassing and deactivating 2FA without 2FA asking for confirmation!

  • Change phone number back to hers (she has an iPhone)
  • Change the email address to a completely unrelated separate account.
  • Added 2FA to her phone number, which the hacker is somehow getting back into the account without triggering a 2FA code to be sent to her phone - we have confirmed the 2FA was setup correctly as it asked her for a code when I attempted to login
  • Manually logged out all other sessions on the Instagram account.
  • Changed password to a completely random string of characters (includes letters of varying case, numbers, and symbols)
  • Password of the old email account was also changed, before then completely changing the email address for the Instagram account.

Somehow the attacker has regained access everytime and has locked my friend out. We're unsure how the attacker is still gaining access, especially with all the info changed (except the username and phone number) and 2FA being enabled. All info on the account gets replaced by the attacker, including 2FA being disabled (we also know that the attacker is also re-enabling 2FA on their device afterwards).

I remember reading years ago about how some attackers had gained access to intercept/receive all messages on someone's phone, thus allowing them to take control of their social media (I don't recall who, but I believe it was a famous tech figure such as Zuckerburg). Perhaps a little far-fetched here as there's nothing significant about the Instagram account (few hundred followers as it's a personal account). We have tried sending text messages to her phone number, both with iMessage enabled and disabled, and she received them. She also received the 2FA code triggered by me when I attempted to login to the account.

How can we regain access for the last time and securely lock down the account and perhaps lock down whatever route the attacker is using to get in and take control. We're really out of ideas now.

Improve this question
2
  • I'm not familiar with Instagram in particular, but is the account somehow being used as a "social media login" on anything? That site or app might be leaking the data to the hacker instead. Also, check if the account has any sort of administrator or parent account that the hacker has added. That sort of thing can be used to take over control of an account since that other account will have superuser access to hers. I half wonder if the hacker is also saying their account has been hacked to claim it back, though, especially since the hacker appears to be reusing the same credentials?
    – user120651
    Commented Mar 18, 2022 at 21:50
  • The hacker must have spyware on the device.
    – Frank
    Commented Sep 10, 2022 at 21:13

3 Answers 3

Reset to default
2

Probably either its one of the problems that got already mentioned in the comments, or the source is hidden deeper and her phone or other devices have a virus or similar (spyware, keylogger, stealing cookies (but for changing the data you need a password) etc) with which the hacker could regain access to her account.

Improve this answer
1

I've been having this same issue: my problem wasn't so much getting back into the account it was more so that the hacker could always just lock me out again.

I tried steps from this video which included removing linked accounts from the accounts centre, which you can find in your settings if you log into Instagram via your browser (perhaps use a laptop).

The video is called "How to recover hacked Instagram account fast 2022" uploaded by 'Ariellevate'.

Improve this answer
1
  • 1
    If there are other steps please include them. Just linking a source of an answer is not allowed here since the answer dies if the link dies. Better to include the steps in the answer itself.
    – schroeder ♦
    Commented Sep 10, 2022 at 20:56
0

It is possible that your friend has also been SIM-jacked. This is where the attacker is able to get a clone of a SIM card and is able to use it in another phone to receive MFA codes. Sometimes it is surprisingly easy to convince a telecom to activate a new SIM on an account. It may be worth exploring that option by calling the telecom provider and seeing if there are multiple SIMs attached to the account. I have also placed a verbal 4-digit PIN on my phone carrier services as an extra layer of authentication.

Consider where the account password is stored. Is it stored in a password manager? A file stored on a dropbox folder? The icloud keychain? They may be able to find the password if it is not stored securely, or if they are able to access whatever service it is stored on. I highly encourage the use of a password manager and checking out if there is any unauthorized access to other accounts such as dropbox or icloud. If your friend was using a simplistic/re-used password, it is very possible that they are able to access these services.

Also do an anti-virus scan on all the computers and monitor for unusual activity on phones. If possible, it may be worth doing a factory reset on the phone to try and remove any hidden malware.

Improve this answer
2
  • But this assumes that all MFA on all the accounts you mention use SMS. Even the place where the password is stored. This fact needs to be called out and you skipped right over that. And with a SIM clone, then the legit phone will also see the SMS. So there will be some noticeable messages.
    – schroeder ♦
    Commented Sep 16, 2022 at 8:21
  • I was assuming that they may not even have MFA installed on the other services, hence the suggestion that maybe someone has managed to get into those services. You are right in that their phone should be getting the MFA text messages even if they have been simjacked, though.
    – PantherModern
    Commented Sep 17, 2022 at 5:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .