A new Instagram phishing campaign is underway, which attempts to trick users of the popular social media platform by luring them with a blue-badge.
See also: Meta: You can publish your NFTs on Facebook and Instagram
Blue badges are highly sought after, as Instagram grants them to accounts that it has verified are authentic, representing a public figure, celebrity, or brand.
The spear emails in the recently discovered phishing campaign inform recipients that Instagram has reviewed their accounts and deemed them eligible for a blue badge.
Users who fall for the scam are asked to fill out a form and claim the verification badge within the next 48 hours.
While the campaign appears to be a scam, the threat actor is betting on the carelessness and excitement that Instagram users have when faced with the opportunity to upgrade their account status on social networks.
See also: Instagram is looking at ways to give you better control over your feed
Campaign details
The new campaign was spotted by threat analysts at Vade, an artificial intelligence -based email security service , who reported that the first messages to targets were sent on July 22.
The messages feature Instagram and Facebook logos and inform the recipient that their account qualifies for a blue badge, prompting them to click an embedded button that will take them to the relevant submission form.
Users are warned that if they ignore the message, the form will be permanently deleted in 48 hours, creating a sense of urgency and the illusion of a limited opportunity.
The phishing form is hosted on a domain called “teamcorrectionbadges”, to make it appear that Instagram uses a separate, dedicated domain for user verification.
The phishing process on this site is based on a three-step form, with each step showing the Instagram, Facebook, WhatsApp, Messenger and Meta logos, in an attempt to create a sense of legitimacy.
The first form asks for a “username”, the second asks the victim to enter a “name”, “email” and “phone number”, while the third and final step asks for the user’s “password”, to verify that they supposedly own the account.
See also: Instagram: Update of sensitive content filters for teenagers
Once the victim completes the process, a message informs them that their account is now verified and that the Instagram team will contact them in the next two days.
How Instagram badges work
To understand how you can protect yourself from these scams, it's important to know how Instagram's verification program actually works.
First, the social media platform will never contact you offering a blue badge. Users can only earn it through their app.
Secondly, requesting verification is only possible through the official platform, never by visiting a separate domain.
Third, Instagram's blue badges are reserved for public figures, celebrities , and brands, so regular accounts are not eligible.
Hackers exploit the vanity that characterizes many Instagram users.
Information source: bleepingcomputer.com
