Instagram is trying to shut down a stalker app that cracks through the social media platform’s privacy settings.
Ghosty was launched by a Turkey-based developer in April, but the app seems to have drawn the ire of Instagram in the last few days. It promises its users access to Instagram accounts that have been set to private and would normally be inaccessible.
As Android Police reports, Ghosty seems to work by gaining access to all the private accounts of those who download it and subsequently providing that access to users who join its sketchy network. When someone downloads the app, they give access to all the accounts they follow, and they have to invite at least one person to download the app (thereby giving Ghosty access to all the accounts that the second person follows). With each new download, Ghosty adds to the pool of private accounts it can let users spy on. So the app doesn’t give users access to every private account—just the accounts that are followed by other Ghosty users.
Ghosty has been downloaded more than 500,000 times, which would mean that it has presumably had access to the private accounts that all those users follow. The app reportedly pushes users to watch ads or pay more in order to see more hidden accounts.
This sort of crowdsourced farming is super shady and a privacy nightmare. And Instagram is trying to put an end to it. Android Police first reported on Saturday that Instagram planned to take action against the app.
Instagram confirmed to Gizmodo that it is “investigating” the app. “Yes, this app violates our terms. This functionality has never been available through our API,” an Instagram spokesperson told Gizmodo, in a statement. “We will be sending a cease and desist letter to Ghosty ordering them to immediately stop their activities on Instagram, among other requests.”
The spokesperson cited Instagrams terms, which state: “You can’t attempt to buy, sell, or transfer any aspect of your account (including your username) or solicit, collect, or use login credentials or badges of other users.”
The Facebook-owned company is also “planning further enforcement relating to this developer.”
Ghosty developer Gurkan Kesgin did not respond to a Gizmodo request for comment.
As of Monday morning, the app had been removed from Google Play, but it is still available for download on the Apple app store.