I remember there was a few months where you could just send a link to someone via dm on instagram and have complete access to their account if they accidentally click it