Apple has removed the “Who Viewed Your Profile – InstaAgent” app from the App Store after a software developer discovered that the app was secretly stealing Instagram credentials from its users.
David LR of PeppersoftDev came across some serious privacy issues while analyzing the source code of InstaAgent, one of the most popular free apps on the App Store, with over 500,000 downloads. The app allowed users to examine their Instagram profile and see the top users who visited their profile.
By monitoring the application's behavior, David found that InstaAgent was collecting Instagram and sending the information to the instagram.zunamedia.com server.
This data wasn't even protected, it was sent unencrypted, meaning anyone who knew where to look could easily intercept a transmission and gain access to thousands of Instagram usernames and passwords in plain text.
Additionally, some users later reported that the app was posting messages on their behalf. The app did not ask for permission from the Instagram API, meaning it was likely using stolen usernames and passwords to do so.
Apple removed InstaAgent from the App Storeafter the issues were reported. Google also removed the Android version of InstaAgent from the Play Store. It has not yet been confirmed whether the Android version contained the spying feature in its code.
This isn't the first case of malicious apps being found on the App Store. In the past couple of months, we've had the XGhostCode debacle where a compromised version of Xcode was used to automatically infect clean apps with malware, and the case of various apps that violated users' privacy or contained malicious SDK code.
