A security researcher from Sucuri , Luke Leal, has discovered a new method that hackers are using to steal Instagram credentials . It's a new phishing campaign that promises users that it will make account their look authentic (that they will receive a "verification badge").
Hackers are using the phishing domain “instagramforbusiness [.] info”, and are asking users to fill out various forms, which steal their credentials. Users are asked to confirm email by providing their email and password .
When victims fill out the form and click “submit,” the information is sent via email to the hackers. This way, they are able to easily access the victim’s account. Typically, Instagram uses various methods to detect suspicious connections. If it does detect suspicious activity, the account is locked and a warning is sent to the user.
To avoid account lockout, attackers need to have access to either the phone number (used to create the account) or the victim's email. For this reason, they make sure to have already stolen the email credentials.
Researcher Leal explains how we can tell this is a phishing attack. First, he states that the domain name is not “instagram.com.” Then, he notes that there is no “https” and finally emphasizes that Instagram will never ask for the password of a linked email, as confirmation.
According to the researcher, many users are tempted by the idea of obtaining a token of authenticity. Hackers know very well how to attract unsuspecting users.
“You should always check the links you click on and ensure that you only provide personal information to legitimate sites. Malicious users are constantly looking for opportunities to trick their victims with phishing campaigns. Stay safe online!”he added.
An Instagram spokesperson said:
“If we need to contact you about something related to your account, we will also notify you through the app Instagram. If you receive an email or other notification (text, etc.) that seems suspicious to you, you can open the Instagram app to check if you have received any notifications there. For added security, we advise Instagram community members to ensure that two-factor authentication.
