A popular app that promised to show you who viewed your Instagram account may have been stealing passwords
The app InstaAgent claimed to offer an appealing use case: the ability to see who views your Instagram profile.
It was also harvesting the passwords of thousands of Instagram users and posting photos to their accounts without their knowledge.
The malware in the app, which has been removed from Apple's App Store and the Google Play Store, was first discovered by a developer for the German app company Peppersoft on Tuesday morning.
By asking users to enter their Instagram logins, "Who Viewed Your Profile - InstaAgent" was collecting passwords tied to Instagram accounts and silently posting photos to comprised accounts in an effort to drive more downloads, Peppersoft's developer revealed.
It's unclear exactly how many people downloaded InstaAgent, but according to the analytics firm App Annie, it did reach the top spot in the App Store's free chart in 15 countries, including the UK and Canada.
Tech Insider has reached out to Instagram for comment and will update this story when we hear back.