InstaAgent, a seemingly popular app that claims to track who has visited a user's Instagram account, has been pulled from the App Store after it was discovered that the app was storing usernames and passwords then sending them to a remote server. The account information harvesting was originally spotted by a Peppersoft developer who broke the news on Twitter:
In a further set of Tweets, @PeppersoftDev also revealed that InstaAgent was advertising the app by posting images to users' Instagram accounts without their knowledge.
The app has since been pulled from the App Store, but it's recommended that users change their login credentials as soon as possible, as well as those for other services that may share the same password. And considering the app was topping the charts in markets such as the UK and Canada before its removal, this has the potential to affect a large number of people.
Though the app is no longer available, there are a number of other apps still on the App Store that claim to perform the same service as InstaAgent. This is just a reminder that it's important to be mindful of who you're trusting login credentials with, especially when it comes to third-party apps and services.