The Nasty List on Instagram: 2026 Scam Guide and Fixes

The Nasty List on Instagram in 2026: the short answer

The Nasty List is a phishing scam, not a real list. A message from a friend's hacked account says you are "on here" and ranked, with a link. The link leads to a fake Instagram login page, and anyone who signs in there hands over their password.[6] The hacked account then sends the same message to its followers, so the scam spreads like a worm.

We found no new large wave of the Nasty List itself in 2026, but the method is alive under other names, such as a "Hot List" of ranked photos.[9] If you already entered your login, Instagram's Help Center points you to instagram.com/hacked to secure the account.[7]

Timeline: the Nasty List from 2019 to 2026

What changed since 2019

The scam itself has barely changed, and that is the lesson. In 2019 it relied on two things: a message from someone you trust, and the fear of being named on a shameful list.[6] Both still work. Variants now talk about a "Hot List" or ask you to vote, and lead to the same kind of fake profile and fake login page.[9]

What did change is recovery. Instagram now sends hacked users to a single page, instagram.com/hacked, and Meta runs an Account Recovery Hub for Facebook, Instagram and Threads.[7][8] In 2019 victims mostly had to find the steps on their own. Forbes at the time advised changing the password through Settings, using Instagram's recovery process if details were changed, and turning on 2FA with an authenticator app.[6]

Search data shows people still look for "nasty link" and "nasty list instagram hack" every month. In our analysis, that means the message keeps reaching new users, or old messages keep resurfacing in inboxes.

Scams linked to the Nasty List (our analysis)

• Look-alike login pages. The page looks like Instagram but sits on another domain. Our original report below names one example domain.
• Fake ranking profiles. Profiles named after the list collect followers and host the next link in the chain.
• Recovery scammers. After a hack, strangers offer to "get your account back" for money. Only Instagram can restore an account; use its official page.[7]
• Second-wave fraud. A hijacked account can message your friends asking for money or for codes. Warn them as soon as you notice.

What to do if you got the Nasty List message

1. Do not log in. If a DM says you are on a list, do not open the link. If you opened it, close the page without typing anything.

2. Change your password. If you did type your login, change the Instagram password right away, and on every other site that used the same password.[6]

3. Turn on two-factor authentication. An authenticator app, as Forbes recommended, blocks most logins with a stolen password.[6]

4. Use instagram.com/hacked. If you are locked out, use this official page or Meta's Account Recovery Hub.[7][8] Ignore people who offer paid recovery.

5. Warn your followers. Post a story or send a note saying the message was not from you, so the chain stops.

6. Report the account. Report the fake list profile in the app, and see our guide on how to report phishing. Check our leak check if you reused the password elsewhere.

What is still unknown

• Who ran the original Nasty List campaign. We found no arrest or attribution as of 2026.
• How many accounts were taken over. We found no official number from Instagram.
• What the attackers did with stolen accounts beyond spreading the message. Our original report lists possible uses, but none was confirmed.

Our original 2019 report

The text below is our report as first published in 2019. We keep it unchanged for the record; the sections above bring it up to date.

A new phishing campaign was spotted in the wild, and this time hackers are targeting users of the Instagram[1] social network. The "Nasty List" scheme is operated by unknown hackers who are determined to steal as many credentials as possible and then spread the fake links further.

The "Nasty List" incident was first spotted around a week ago by a Reddit user, who said that he received a direct message from his sister:[2]

So I logged onto Instagram yesterday and I had a dm from my sister. It said I was in some kind of "Nasty List". Well I had just woken up and I was kind of out of it so I clicked on it because I was curious. I then realized that it was probably a virus, but too late, I had already clicked.

It is yet unknown what is bad actors' ultimate goal; however, the scam allows them to completely take over the Instagram account. In the future, a well-established botnet could be used to spread malware such as banking trojans or into-stealers (such as screen-locking Anubis[3] or crypto wallet targeting Gustuff)[4], which could compromise users' bank accounts or even result in identity theft. Alternatively, the stolen credentials might be simply sold on the Dark web for profits.

The phishing link leads users a spoofed Instagram login page

Those whose accounts got compromised are then used to spread the phishing links to all the victim's followers, who then consequently get curious about what the "Nasty List" is and why are they on it.

The Nasty List scam starts when users receive a seemingly trustworthy direct message from one of the Instagram followers and usually begins with something like "WOW. Your on here!!! ranked 100," "OMG your actually on here, @The_Nasty_List_918," "WTF you are literally on here," "omg your #15 on this list. So messed up."

There is no doubt that many users might get curious and even concerned about these statements. Once clicked on the link, they are directed to a fake Instagram profile that is usually named "Nasty List," "YOUR ON HERE," "The Nasty," and similar (some of such profiles already have around 30k followers).

On the fake profile, victims find another link, which, once clicked, leads them to a spoofed Instagram login screen, which looks credible. Nevertheless, those who pay close attention will see that the URL at the top of the screen is not the official Instagram page, but rather "nastylist-instatop50.me," or something similar.

Unfortunately, those who enter their credentials will get their accounts compromised and provide full control to hackers. To avoid such events in the future, never enter your credentials to sites that do not belong to Instagram.com domain.

Those who did not enter their Instagram login details are not affected by the compromise

Many users who fell for the scam said that they either did not give too much thought to it before clicking the link as it came from a trusted source, or the anxiety of something shameful behind the link prompted them. Due to these factors, the "Nasty List" scam might affect thousands, if not millions of users.

However, if you clicked on the first link and got redirected to the fake profile, and even clicked on the second link without entering your credentials, you are safe. Additionally, those who have two-factor authentication enabled will prevent hackers from compromising their accounts.

In case you did enter your credentials, you should immediately change your password on Instagram, and all the other accounts that you used the same password for. Also, do not forget to check if all the contact information such as email address and phone number are correct and. To change the password on Instagram, follow these steps:

• Go to your profile on the Instagram
• Select Settings > Privacy and Security > Password
• Enter the new/current password, and tap on Save

Additionally, security experts highly recommend enabling two-factor authentication (2FA)[5] on all accounts, as it would prevent any type of similar attacks in the future.

Related guides on 2-Spyware

• How to report phishing
• Check whether your email appeared in a leak
• Recent data breaches
• Virus and malware removal guides