Attackers abused Meta’s AI-powered High Touch Support tool to hijack over 20,000 Instagram accounts, exploiting a missing email verification check to bypass 2FA and access passwords, DMs, and personal data for over six weeks before detection.
Attackers exploited a flaw in Meta’s AI-powered High Touch Support tool to hijack over 20,000 Instagram accounts, bypassing two-factor authentication entirely. The campaign ran undetected from April 17 to May 31, 2026.