The most absurd recent Instagram "exploit" case

A new type of security vulnerability that hijacks Instagram accounts using Meta's Support AI has been reported.

Attackers use a VPN or proxy similar to the target's location to bypass the security algorithm, then claim to Meta's Support AI that the account has been hacked. They then request that the verification code be sent to an arbitrary email controlled by the attacker, exploiting the loophole that the AI does not check whether that email has already been used.

At the identity verification step requiring a video selfie, it is reported that attackers can pass verification using AI animation technology applied to photos of the target.

This vulnerability completely neutralizes existing two-factor authentication (2FA), and immediately changes the account's email and phone number to the attacker's own, making it difficult for the original owner to recover the account. Notable accounts, including the Obama White House account, have been victimized by this method, and it is currently understood that Meta has patched the issue.