Social media growth tools promising rapid follower increases are popular among Instagram users, but not all are safe. Security researchers have uncovered a malicious Python package on PyPI, imad213, which masquerades as a legitimate Instagram growth tool while secretly stealing users’ login credentials. Distributed with professional branding, detailed instructions, and seemingly safe recommendations, the package convinces users to install it, often using temporary accounts to appear cautious.
Once executed, it saves credentials in plaintext and transmits them to multiple third-party services, enabling large-scale abuse or resale. The malware also uses a remote “kill switch” and legitimate hosting services to evade detection. Users who fall victim risk account hijacking, privacy breaches, and potential cross-platform attacks, highlighting the need for vigilance.
Read More: Instagram Introduces Easier Way to Remove Inactive Followers
PyPI Malware Masquerading as a Social Media Booster
The package, named imad213, was created by an actor using the alias im_ad__213. It was distributed with professional branding, including a detailed README file and seemingly legitimate safety instructions, designed to earn users’ trust.
Promoted as a tool to increase Instagram followers, it initially encourages users to employ temporary accounts, giving the appearance of security. Installation is as simple as running pip install imad213, after which the user encounters a polished interface labeled “INSTA-FOLLOWERS”—a convincing façade that conceals malicious intent.
How the Malware Operates
Once executed, the tool connects to a remote file hosted on Netlify, acting as a “kill switch” that allows the attacker to disable the malware at will, complicating detection and mitigation efforts.
After passing this check, the tool prompts users for Instagram credentials under the pretense of account verification to provide follower boosts. These credentials are stored in plaintext on the victim’s device, with Arabic-language comments embedded in the code to obscure the actor’s intentions.
The malware then transmits the stolen credentials to ten different Turkish-hosted bot services, each with professional-looking interfaces and fake disclaimers. These services can resell or misuse the login details on a large scale.
Coordinated Credential-Harvesting Campaign
Investigation reveals a broader campaign, including similar packages like taya, a-b27, and poppo213, which share branding, ASCII art, and coding patterns. The operation targets not only Instagram users but also gamers on platforms such as Free Fire and other social media communities.
Using legitimate hosting providers like Netlify for command-and-control operations allows the malware to exploit trusted infrastructure, making detection harder. The distribution of credentials across multiple sites suggests a credential laundering strategy, further obscuring the origin of stolen data.
Future iterations could leverage advanced social engineering tactics, decentralized networks, and fake security features to increase compromise rates while remaining difficult to trace.
Risks to Users
Users who provide credentials risk account hijacking, loss of private messages, and potential cross-platform attacks if passwords are reused. Instagram warns that using unauthorized tools to inflate followers can result in account suspension or permanent bans.
Recommendations
Security researchers advise the following:
- Exercise extreme caution when installing third-party growth tools from PyPI or unofficial sources.
- Enable multi-factor authentication and use unique passwords for social media accounts.
- Developers should integrate advanced security scanning tools into CI/CD pipelines to detect suspicious packages before integration.
By remaining vigilant and following best practices, users can protect themselves against credential theft and the growing threat of malicious social media tools.
Frequently Asked Questions
What is the malicious Python package targeting Instagram users?
The package is called imad213, available on PyPI, and disguised as an Instagram growth tool. It steals users’ credentials and transmits them to third-party services.
How does the malware convince users it is safe?
A: It comes with professional branding, a detailed README, and safety recommendations, such as using temporary accounts. The interface, labeled “INSTA-FOLLOWERS, appears legitimate, lowering user suspicion.
How are the stolen credentials used?
After being saved in plaintext on the victim’s device, credentials are sent to multiple Turkish-hosted bot services. These services may resell or misuse the login information across social media platforms.
Can this malware be detected easily?
Detection is difficult. The malware uses a remote “kill switch” hosted on Netlify, allowing attackers to disable it at will. It also leverages legitimate hosting providers to appear trustworthy.
Are similar malicious packages being distributed?
Yes. Researchers have identified related packages such as taya, a-b27, and poppo213, which share coding patterns and branding. The campaign targets Instagram, gaming platforms, and other social media users.
What risks do users face if they enter their credentials?
Risks include account hijacking, loss of private messages, and potential cross-platform attacks if the same password is reused. Users may also face account suspension or bans from Instagram for violating policies.
Conclusion
The discovery of imad213 highlights the growing threat posed by seemingly legitimate Instagram growth tools. These malicious packages exploit trust, disguise their operations with professional branding, and harvest sensitive credentials for wide-scale abuse. Users who fall victim risk account hijacking, privacy breaches, and potential cross-platform attacks, while developers face the danger of inadvertently introducing malware into their projects.
