Instagram, the popular photo and video sharing service acquired by Facebook, is often a target for spam and scams, some of which we have written about over the past year. This week, a friend shared an in-stream advertisement for a program called Instagram for PC on his Facebook timeline. This application claims to run Instagram in an emulator, so that PC users can access the service without a phone.
Figure 1. Instagram for PC website
When trying to download a copy of Instagram for PC, we observed two separate downloads.
File #1: Missing Dynamic Link Library (.dll) File
The first download was a large RAR archive that bundled a series of dynamic link library (.dll) files along with the supposed application. When a user attempts to run the application, they will be greeted with what looks like a login screen for Instagram.
Figure 2. Instagram for PC login screen
In reality, this login screen is a fake. If a user tries to login, they receive a phony “Fatal error 2.4.5” message, claiming there is a missing .dll file.
Figure 3. Fake error message for Instagram for PC
If the user selects “Yes” on the dialog for the missing file, they are redirected to a page that discusses the error and how it can be fixed.
Figure 4. Fake missing .dll page
The language used to explain the error is fishy. Not only that, but the page claims that if the download “won’t” work, the user should click a variety of social sharing options before trying the download again.
When a user tries to download the missing .dll file, they’re asked to fill out a survey.
Figure 5. Instagram for PC survey scam
File #2: Activate Instagram
The most recent version of Instagram for PC now claims that in order for the application to work, the user needs to “activate” Instagram. At the bottom of the application, there’s even a warning in red text that the service is “not activated.”
Figure 6. Instagram for PC activation screen
Clicking on “Click here to activate” results in a new pop-up window that again asks the user to “complete a quick offer or survey” in order to activate Instagram.
Both of the supposed versions of Instagram for PC do not deliver as promised. This is just another vehicle for the scammers to convince users to fill out surveys, so they earn money through shady affiliate programs.
Over 4,000 people have posted about the Instagram for PC site on Twitter and Facebook, while over 2,000 have shared it on Google+.
Figure 7. Social sharing icons from the Instagram for PC website
For anyone that downloaded these files, there was no malicious functionality bundled with the software, such as a keylogger or back door. Symantec products detect these files as Downloader.MisleadApp.
If you’re a PC user and you want to access Instagram on your computer, look no further than instagram.com. Yes, the site itself provides access to the service on any browser on any platform.
If you are a social network user, be wary of scammers trying to find ways to convince you to provide your login details, install applications, or copy and paste code into Web pages. Do not click on suspicious links and report any suspicious links using the reporting functionality within Facebook and other social networks. These are all tactics that have been used time and time again because they work.