Instagram's Algorithms Serve Up COVID-19 Misinformation, Study Finds

An anonymous reader quotes a report from NPR: Instagram recommended false claims about COVID-19, vaccines and the 2020 U.S. election to people who appeared interested in related topics, according to a new report from a group that tracks online misinformation. From September to November 2020, Instagram recommended 104 posts containing misinformation, or about one post a week per profile, to 15 profiles set up by the U.K.-based nonprofit. The automated recommendations appeared in several places on the photo-sharing app, including in a new "suggested posts" feature introduced in August 2020 and the "Explore" section, which points users toward content they might be interested in.

To test how Instagram's recommendations work, the nonprofit, working with youth advocacy group Restless Development, had volunteers set up 15 new Instagram profiles. The profiles followed different sets of existing accounts on the social network. Those accounts ranged from reputable health authorities; to wellness, alternative health, and anti-vaccine advocates; to far-right militia groups and people promoting the discredited QAnon conspiracy theory, which Facebook banned in October. Profiles following wellness influencers and vaccine opponents were served up posts with false claims about COVID-19 and more aggressive anti-vaccine content, the researchers found. But the recommendations didn't end there. Those profiles were also "fed election misinformation, identity-based hate, and conspiracy theories," including anti-Semitic content. Profiles that followed QAnon or far-right accounts, in turn, were recommended disinformation about COVID and vaccines -- even if they also followed credible health organizations. The only profiles that were not served up misinformation followed, exclusively, recognized health organizations, including the Centers for Disease Control and Prevention, the World Health Organization and the Gates Foundation. Facebook spokesperson Raki Wane told NPR: "This research is five months out of date and uses an extremely small sample size of just 104 posts. This is in stark contrast to the 12 million pieces of harmful misinformation related to vaccines and COVID-19 we've removed from Facebook and Instagram since the start of the pandemic."

"We're also working on improvements to Instagram Search, to make accounts that discourage vaccines harder to find," Wane said.

The study can be found here (PDF).

Read more of this story at Slashdot.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Instagram's Algorithms Serve Up COVID-19 Misinformation, Study Finds
id: 0fdeda7e-9a34-4b02-97b5-6a21cd3104f1
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Instagram\'s Algorithms Serve U" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Instagrams Algorithms Serve Up COVID-19 ")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Instagrams Algorithms Serve Up COVID-19 *"

CommonSecurityLog
| where Message has "Instagrams Algorithms Serve Up COVID-19 "
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc