A popular app that promised to show you who viewed your Instagram account may have been stealing passwords

Alex Heath

Nov 11, 2015, 08:48 IST

Screenshot

The app InstaAgent claimed to offer an appealing use case: the ability to see who views your Instagram profile.

It was also harvesting the passwords of thousands of Instagram users and posting photos to their accounts without their knowledge.

The malware in the app, which has been removed from Apple's App Store and the Google Play Store, was first discovered by a developer for the German app company Peppersoft on Tuesday morning.

By asking users to enter their Instagram logins, "Who Viewed Your Profile - InstaAgent" was collecting passwords tied to Instagram accounts and silently posting photos to comprised accounts in an effort to drive more downloads, Peppersoft's developer revealed.

#InstaAgent is only able to post a image in your #Instagram account because they got your account password!#hacked pic.twitter.com/0vD1OJBY9l
- David L-R (@PeppersoftDev) November 10, 2015

Surprise, surprise , #InstaAgent is also posting images without you permission in your #Instagram profile ?? . pic.twitter.com/Syvsv71wcn
- David L-R (@PeppersoftDev) November 10, 2015

It's unclear exactly how many people downloaded InstaAgent, but according to the analytics firm App Annie, it did reach the top spot in the App Store's free chart in 15 countries, including the UK and Canada.

Tech Insider has reached out to Instagram for comment and will update this story when we hear back.