38,811 Instagram X Users at Risk From Autolikes Breach

HEROIC analysts confirmed the Autolikes breach on July 9, 2025. Autolikes is a Japanese desktop application that automates likes and engagement on Instagram and X, formerly Twitter. The exposed dataset contains 38,811 user records including email addresses and pHpass password hashes.

Why the Autolikes Breach Is Dangerous

Picture this scenario. You installed Autolikes months ago to grow an Instagram account. You forgot about it. Today, attackers are running its leaked credentails against Instagram, X, Gmail, and every other major platform. If you reused the password, they are logging in right now and either posting spam, draining connected wallets, or stealing your contacts. pHpass is stronger than MD5 but still crackable offline with modern hardware.

What Was Exposed in the Autolikes Leak

• Email addresses
• pHpass password hashes

Why This Matters

Automation tools draw users who manage multiple social accounts, which makes the Autolikes dataset a prime target for credential stuffing. Attackers use the hash file to crack weak passwords offline, then pair the email and recovered password against other sevices. The result is silent account takeover, which can be used to scam followers, run phishing campaigns, or hijack connected advertising accounts and ad spend.

How the Autolikes Database Dump Works

A database dump is a direct export from the application backend, containing the core user table with login and hashed password fields. The Autolikes dump appears to be a clean export rather than a fragmented steal, meaning every active account at the time of compromise is likely in the file. Once posted on hacking forums, the data gets folded into combolists and used against unrelated sites within days.

Check If You Are Affected

HEROIC monitors the Autolikes breach as part of a 400 billion record database of stolen credentails. A free scan will tell you instantly if your email appears in the Autolikes dataset or any connected leak.