What to Do If Your Social Media Account Starts Posting Spam

If your social media account starts posting spam, secure the account first: change a reused or weak password, enable MFA, sign out unknown sessions, and remove connected apps you do not recognize. Then delete or hide scam posts and warn contacts.

Spam posts do not always mean someone knows your password. A connected app, stolen session, malicious browser extension, or compromised device may be involved.

Do not click your own spam links to investigate. Preserve evidence if fraud or business harm is involved.

Spam posting often comes from apps with posting permission, old automation tools, reused passwords, phishing, malware, or shared devices. Some scams use your account reputation to target friends.

The FTC recommends checking account settings, messages, and recovery information after a social account is compromised. CISA recommends MFA as a core protection.

If the account is tied to a business page or ads account, check payment and admin settings too.

Check your account email or username for known exposure. If a password was reused on another breached service, replace it everywhere.

Never enter current passwords or one-time codes into exposure checkers. A clean result does not rule out app abuse or stolen sessions.

Change the password from the official app or website. Use a unique password and enable MFA. Sign out unknown devices and review recovery email and phone.

If you cannot log in, use the platform's official recovery process.

Review apps, games, automation tools, browser extensions, and integrations connected to the social account. Remove anything unnecessary or unknown.

An app with posting permission can continue causing problems even after a password change.

Delete spam posts after preserving evidence if needed. If direct messages were sent, warn affected contacts not to click links, send money, or share codes.

Ask contacts to report scam messages through the platform.

Update your device and browser, remove suspicious extensions, and run trusted security checks if you installed anything unusual.

Avoid changing passwords from a device you think is infected.

For the next few weeks, watch login alerts, posts, direct messages, profile links, ads, and connected apps. If spam returns, a hidden access path may still exist.

Use official reporting if money or identity misuse occurred.