Top-ranking free app InstaAgent stole Instagram passwords

'Who Viewed Your Profile - InstaAgent' secretly sent user passwords to its developer's server, and posted images without permission

An Instagram client which was the most downloaded free app in Britain and Canada has been silently stealing usernames and passwords and uploading them to its developer's server.

The app, marketed as "Who Viewed Your Profile - InstaAgent", claimed to allow users of the social network to track the people that have visited their account. But users who logged into the account instead had their credentials uploaded, unencrypted, to a third-party server.