My other half discovered that some dodgy person/company had managed to send instagram messages advertising handbags to all of her followers from her account. She changed her password immediately, but what could have happened here? Is it the case that a “hacker” had access to her full instagram account, or would they have used some tool that allows posting of messages via some kind of proxy without requiring access to her actual account? There was no record of other logged in devices on the security page of her account.
Update: She’s just been through her junk email folder and found a “We’ve noticed a new login” email from instagram yesterday, so I presume that means they were fully in to the account then. How they got the password is anyone’s guess, but could be any of the suggestions below. Thanks all for the responses.
Are the messages in her outbox? What some scammers do is they make a new account with the same name and profile picture, to then send messages that look like they’re from a friend.
I remember reading about an Facebook phishing thing going around, but that involved getting the password and then spamming out messages. She could try and remember if she got any weird links that she logged in with. Sometimes the scammer sends the harmful link to the followers, so the handbag site might be the problem link
None of the messages that were sent to people have appeared in the chat history for that person. Except there are two new chats in her messages to people that she doesn’t know, containing only the rogue message.
Interestingly, her entire chat history with me has been wiped.
google “session stealer”. your partner probably clicked on the malicious link and provided hackers full access to the account. not sure if signing out of all devices helps, but do it anyway.