Third-party Instagram app was stealing thousands of passwords

Andre Yoskowitz
11 Nov 2015 12:31

Third-party Instagram client 'InstaAgent' has been removed from both the Apple App Store and the Google Play Store after it was discovered it was stealing passwords and posting photos without permission.
The app was found to be storing your Instagram username and password in unencrypted text, and the app was then sending the details to an unknown server.
InstaAgent was popular as it promised to let you see "who viewed your profile," a feature that is not included in the official app.
The app had over 100,000 downloads from the iOS App Store alone, so there is a good chance that hundreds of thousands of accounts have been compromised. If you ever used the app, it stands to reason that you should be changing your password before finishing this article.
Source:

"Who Viewed Your Profile" #Instaagent will send your Instagram Username and Password to an unknown server! pic.twitter.com/8uZJljJdtO

-- David L-R (@PeppersoftDev) November 10, 2015