Instagram accounts take downs and the role of ‘OGUsers’ explained

Facebook said it had taken down many Instagram accounts a few weeks ago, stating that an account-hijacking forum called ‘OGUsers’ was involved in stealing accounts by way of hacking and SIM swapping

Multi-factor authentication on social media and banking accounts can help prevent attacks.

(Subscribe to our Today's Cache newsletter for a quick snapshot of top 5 tech stories. Click here to subscribe for free.)

A few weeks ago, Facebook Inc took down several Instagram accounts that were hacked and sold for large sums of money, including the accounts of people behind this activity . The people engaged in the malpractice are said to belong to a group called OGUsers, an online marketplace that buys and sells popular and high-value usernames. The platform is often referred to as an ‘account hijacking forum’.

The group began operations in April 2017 to sell shorter and unique usernames that are often desirable to social media users. It now has over 50,000 registered users who have generated millions of posts, and nearly a 1,000 of them are active daily, according to security firm Avast.

Facebook to add more account security features next year

The forum has displayed a pattern of stealing accounts. It intimidates, coerces and harasses users some time, and another other time, resorts to hacking and SIM swapping. Many users involved in the practice were minors, according to a Reuters report.

Who else is affected?

Instagram isn’t the only social network that fell prey to the group’s attack. OGUsers members have previously hijacked accounts on Facebook, TikTok and Twitter.

Twitter said that it worked with Facebook to seize accounts tied to top members of OGUsers, citing that it went against the platform’s manipulation and spam policy. Short-video platform TikTok also confirmed it took action to reclaim an undisclosed number of target accounts.

OGUsers themselves were subject to hacks nearly three times in the past , according to investigative journalist Brian Krebs who has been tracking the group actively.

The latest attack took place in December last year when attackers taunted forum members saying they could have their profiles and private messages removed from impending database leak by paying between $50 and $100, Krebs explained in his website.

Krebs described the sentiment as “schadenfraud”, a play on the German word that means deriving pleasure from another person’s misfortune.

Multi-factor authentication on social media and banking accounts can help prevent attacks. Adding another layer of password on a mobile phone account may help as well, according to Avast.