A request from a familiar account
A friend contacted me after a relative followed an Instagram message asking for a vote in a competition. It appeared to come from an old school acquaintance. The link led to a page offering familiar-looking Instagram, email, and Facebook sign-ins.
She intended to help someone. Instead, the copied login page collected credentials. A personalized short link and convincing design made the request feel legitimate.
The attacker changed the recovery path
During the night, notifications showed changes to the account’s email and password. An unfamiliar phone number and two-factor authentication were added. Resetting the password alone didn’t remove those other controls.
We also encountered an unfamiliar linked Facebook profile and additional account relationships. Some changes were difficult to reverse while the attacker still had access.
What recovery involved
We used Instagram’s official hacked-account process. The verification route requested identity-related information and eventually provided a recovery opportunity. The exact steps and availability depend on the account; no third party can promise a guaranteed shortcut.
After regaining access, the owner needs to review active sessions, password, email, phone number, two-factor methods, recovery codes, and linked accounts together. Use recovery details controlled by the owner, even when someone else helps.
Secure the surrounding accounts
Protect the email account used for recovery and change reused passwords on other services. Warn contacts through a trustworthy channel if the compromised profile sent them messages. Preserve evidence and report the incident through appropriate channels.
What the technical clues don’t prove
The original investigation noted hosting information, script files, and apparent login locations. A country code, IP location, or old domain registration doesn’t identify the attacker. A script’s presence also doesn’t prove that a browser granted camera, location, or clipboard permissions.
The account contained unfamiliar personal and payment-related records. Those details aren’t reproduced here. Their presence warranted reporting and investigation, not assumptions about the identity of every person involved.
The lesson is practical: enable your own 2FA early, verify unusual requests through another channel, and treat recovery as a review of every route back into the account.
