--- title: "Instagram phishing campaign dangles \"blue badges\" as lure" description: "A new Instagram phishing campaign has been discovered, attempting to scam users of the popular social media platform by luring them with the offer of a coveted \"blue badge\" — official verification of the user's profile. As part of the alleged verification process, users are asked to reveal their password and other sensitive information, all of which is sent directly to the attacker." canonical_url: https://www.acronis.com/en/tru/posts/instagram-phishing-campaign-dangles-blue-badges-as-lure/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 12 September 2022 # Instagram phishing campaign dangles "blue badges" as lure A new Instagram phishing campaign has been discovered, attempting to scam users of the popular social media platform by luring them with the offer of a coveted "blue badge" — official verification of the user's profile. As part of the alleged verification process, users are asked to reveal their password and other sensitive information, all of which is sent directly to the attacker. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** [Video 1](https://www.youtube.com/watch?v=9nQXWfrjE6c) A new Instagram phishing campaign has been discovered, attempting to scam users of the popular social media platform by luring them with the offer of a coveted "blue badge" — official verification of the user's profile. As part of the alleged verification process, users are asked to reveal their password and other sensitive information, all of which is sent directly to the attacker. The campaign spikes more than 1000 emails per day and has been active for several weeks. Attackers create a sense of urgency and the illusion of a limited opportunity by warning users that if they ignore the message, the submission form for the blue badge will be permanently deleted in 48 hours. Enabling multi-factor authentication (MFA) can help minimize the risk and safeguard your account, but it's not a silver bullet. A phishing framework called EvilProxy, for instance, can be used to steal session cookies and bypass MFA for many popular services. The [Advanced Email Security pack](https://www.acronis.com/en-us/products/cloud/cyber-protect/email-security/) for Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) blocks phishing emails from ever reaching users' inboxes, preventing them from revealing their credentials in such attacks. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)