InstaAgent is an app which connects to an account on the picture-sharing service Instagram with the promise to track the users that visit the account. The app, however, has turned out to be a malicious program.
The malicious app stores the username and password of the Instagram user, and then sends the information to a remote server.
A Peppersoft app developer downloaded the app, which has the full name of Who Viewed Your Profile - InstaAgent, and found out that the app reads the username and passwords of the user's Instagram account and sends it on clear text to the remote server instagram.zunamedia.com.
"Who Viewed Your Profile" #Instaagent will send your Instagram Username and Password to an unknown server! pic.twitter.com/8uZJljJdtO
— David L-R (@PeppersoftDev) November 10, 2015
The same developer also discovered that InstaAgent is using the retrieved credentials to access Instagram accounts and post images without the knowledge of the user. Instagram prohibits third-party apps from uploading pictures on the accounts of users.
Surprise, surprise , #InstaAgent is also posting images without you permission in your #Instagram profile
