Instagram is alerting users who were targeted by hackers during AI chatbot attacks
Instagram is alerting users who were targeted by hackers during AI chatbot attacks
Instagram 正向在 AI 聊天机器人攻击中被黑客盯上的用户发出警报
The widespread hacking campaign that relied on simply asking Meta AI’s chatbot to take over a victim’s Instagram account appears to have continued even after the company said the issue had been resolved. Meanwhile, the company has been scrambling to secure the targeted accounts and alert victims. 一场大规模的黑客攻击活动似乎仍在持续，尽管 Meta 公司声称问题已经解决。该攻击手段非常简单，只需要求 Meta AI 的聊天机器人接管受害者的 Instagram 账号即可。与此同时，Meta 公司正忙于保护受影响的账号并向受害者发出警报。
Over the weekend, hackers claimed to be exploiting Meta’s AI support chatbot to take over several high-profile Instagram accounts. At the same time, a large number of people complained on social media that their Instagram accounts had been hacked, some of them with unique short user-profile handles. TechCrunch has seen examples of allegedly hacked handles featuring common forenames or names of countries, which can be then re-sold almost as collectibles in a gray market for so-called “OG handles.” 上周末，黑客声称利用 Meta 的 AI 支持聊天机器人接管了多个高知名度的 Instagram 账号。与此同时，大量用户在社交媒体上抱怨自己的账号被盗，其中一些账号拥有独特且简短的用户名。TechCrunch 看到了一些据称被盗账号的案例，这些账号通常是常见的名字或国家名称，它们可以在所谓的“OG 账号（原始账号）”灰色市场上像收藏品一样被转售。
Other victims of the hacking spree appeared to be the dormant Obama White House account (which Meta disputed), and the account of the U.S. Space Force’s chief master sergeant, John Bentivegna. These attacks were so simple that calling them hacks may be giving the people behind them too much credit, while at the same time not putting enough blame on Meta for not preventing rudimentary attacks from hijacking people’s accounts. 此次黑客攻击的其他受害者似乎还包括处于休眠状态的奥巴马白宫账号（Meta 对此予以否认），以及美国太空军总军士长约翰·本蒂韦尼亚（John Bentivegna）的账号。这些攻击手段极其简单，称其为“黑客攻击”或许是对幕后黑手的过誉，同时也未能充分追究 Meta 在防止此类低级攻击劫持用户账号方面的责任。
Hackers simply told Meta’s AI chatbot that they were the owners of the target’s account, and asked the bot to link that person’s account to an email they controlled. The chatbot complied with the request, allowing the hacker to reset the target account’s password and take control of the account — in some cases locking out the victims. At no point were Meta employees or contractors involved in the chat. 黑客只需告诉 Meta 的 AI 聊天机器人他们是目标账号的所有者，并要求机器人将该账号关联到他们控制的电子邮箱即可。聊天机器人照办了这一请求，允许黑客重置目标账号的密码并夺取控制权——在某些情况下，受害者会被直接踢出账号。整个聊天过程中，Meta 的员工或承包商并未参与其中。
On Monday, Meta spokesperson Andy Stone said that “the issue that did happen has already been fixed.” On Tuesday, however, more Instagram users claimed to have had their accounts hacked. At the same time, TechCrunch has seen discussions among members of a Telegram channel where the hacking technique had been publicized, who claimed to still be able to exploit Meta’s AI chatbot, and they were advertising apparently hacked handles for sale, even at the time of TechCrunch’s writing. 周一，Meta 发言人安迪·斯通（Andy Stone）表示：“此前发生的问题已经得到修复。”然而，周二仍有更多 Instagram 用户声称自己的账号被盗。与此同时，TechCrunch 在一个发布了该黑客技术的 Telegram 频道中发现，成员们声称仍然能够利用 Meta 的 AI 聊天机器人，并且在 TechCrunch 撰写本文时，他们仍在兜售据称是被盗的账号。
In a later post on X, Stone said: “Some people may receive password reset notifications and some may be asked security questions when they try and log into their accounts.” Stone told TechCrunch in an email that Meta secured affected accounts on Monday, then began sending password reset emails. When asked by TechCrunch, Stone would not say how many users were hacked. 在随后发布于 X（原 Twitter）的一条消息中，斯通表示：“一些用户可能会收到密码重置通知，部分用户在尝试登录账号时可能会被要求回答安全问题。”斯通在给 TechCrunch 的邮件中称，Meta 已于周一保护了受影响的账号，并开始发送密码重置邮件。当被 TechCrunch 问及有多少用户被盗时，斯通拒绝透露具体数字。
Several people have reported that Meta has begun notifying users that they were being targeted. Victims publicly reported receiving emails from Instagram warning them that the company had “detected some suspicious activity that suggests your Instagram may have been compromised.” The message also said that the company took measures to secure the account, and asked the user to reset their password. 多名用户报告称，Meta 已开始通知那些被盯上的用户。受害者公开表示收到了来自 Instagram 的邮件，警告称公司“检测到一些可疑活动，表明您的 Instagram 可能已被入侵”。邮件还表示，公司已采取措施保护该账号，并要求用户重置密码。
As 404 Media noted, Meta announced in March that it was implementing AI to automate its support to users, saying the AI-powered chatbot was “designed to resolve account issues from start to finish,” and would have the ability to “reset your password securely.” That suggests the chatbot can perform actions that may have previously required a human in the loop, given how critical they were. 正如 404 Media 所指出的，Meta 在三月份宣布将引入 AI 来实现用户支持自动化，称该 AI 聊天机器人“旨在从头到尾解决账号问题”，并具备“安全重置密码”的能力。这表明该聊天机器人能够执行一些以前可能需要人工介入的关键操作。
For years there has been a flourishing market where hackers stole and then sold “OG” usernames, referring to the usernames and handles taken by the earliest users of Instagram. In the past, however, taking over those accounts required more complex strategies, such as phishing the victim, taking over their phone number, or bribing insiders at telecom providers. Here, the hackers just asked, and Meta’s chatbot dutifully complied. 多年来，黑客窃取并转售“OG”用户名（指 Instagram 早期用户注册的简短用户名）的市场一直很繁荣。然而在过去，接管这些账号需要更复杂的策略，例如对受害者进行网络钓鱼、劫持其手机号码或贿赂电信运营商的内部人员。而这一次，黑客只需开口要求，Meta 的聊天机器人便顺从地照办了。