At the end of last week, Dutch police arrested two suspects on suspicion of hacking multiple Instagram accounts and then using them to solicit illegal payments for providing advertising services.
The two suspects, whose names have not yet been released, are 18 and 19, from Alblasserdam and Boskoop, two neighboring towns near Rotterdam and The Hague.
The two teenagers are accused of sending spear-phishing emails to their victims that mimicked genuine Instagram notifications, asking users to log in to their accounts.
Using this simple technique, the teens recorded the passwords of hundreds of Instagram accounts. Police say the teens specifically targeted the owners of Instagram accounts that had thousands of followers.
Once they had the password of a "promising" account, the teens would then contact the companies, offering them the opportunity to advertise the account's followers.
The practice of posting on Instagram (Twitter or Facebook) posts depicting a company's products is popular, and many online celebrities are paid, often tens of thousands of dollars per social media post.
Dutch broadcaster NOS reports that the two young men made tens of thousands of euros by placing advertisements from various companies on compromised accounts.
Once they had an offer, they would log into the hacked account, post the ad, and receive the cash, which they would later exchange for Bitcoin.
"These companies [advertisers] probably don't realize they're dealing with hackers," a police spokesman told NOS. "They [the hackers] made decent amounts [of money]."
Police say the teenagers were not limited to Dutch Instagram accounts and also hacked profiles belonging to users from other countries.
Not all hacked accounts have 2FA (two-factor authentication) enabled, which made the hackers' job much easier.
