Instagram credentials Stealers: Free Followers or Free Likes

McAfee Mobile Research identified Android/InstaStealer, an Android app that masquerades as an Instagram followers/likes booster but redirects users to a malicious website via WebView to collect Instagram credentials. The operator stores and reuses those credentials to generate followers for other users, causing account compromises and enabling secondary attacks (e.g., credential stuffing); distribution occurs through Telegram channels and YouTube promotions. McAfee provides two SHA256 hashes and the domain https://insfreefollower.com as indicators of compromise and recommends against using follower-boosting apps.