The message comes from someone you know. The link looks short and harmless. When you click it, you’re sent to a page that looks like Facebook or Instagram and asks you to log in again for security. If you do, the scammer now has your account, and the next message goes to all of your friends from you. The chain keeps going.
This works because the message came from a real friend whose account just got taken over five minutes ago. The lure plays on a very specific kind of panic: wait, is there a video of me? That moment of dread is the only moment they need.
Once they have your account, they can scrape your friends list, message your contacts, post in your name, and sometimes lock you out by changing the recovery email.