FYI.

This story is over 5 years old.

Tech

Third-Party Instagram App InstaAgent Stole Passwords and Posted to Accounts

The iOS developer who caught it estimates that it was downloaded by half a million users.
Rachel Pick
New York, US

Beware of apps that seem to promise the impossible—like being able to tell you who's been viewing your Instagram profile. They may just be clever schemes designed to harvest your password.

Such was the case with InstaAgent, an app that was available in both the App Store and Google Play (it has since been pulled from both stores) until an iOS developer noticed what it was up to. InstaAgent would steal your username and password, uploading them unencrypted to a server. The app could then post to your account without your permission.

According to Apple Insider, the app was popular in the UK and Canada, and was downloaded by a half a million users. This is not a large number of app downloads in the grand scheme of things, but it's a large number of people whose Instagram security could be at risk.

App store malware seems to be on the rise. Back in September, Chinese app developers unwittingly used an infected version of the app development program Xcode, when went on to pull user data from apps built under legitimate pretenses.

Instagram tries to deter users from downloading third-party apps like InstaAgent, and this is a good reminder as to why you should not use apps like this that ask you to share your password for something else. If you've downloaded InstaAgent or any similar-sounding app, you should change your password.