 They capture your password when you log in, and then they log in on your behalf somewhere else. Now, Instagram does have some built-in safeguards. They will say, are you sure you're logging in from some foreign country somewhere halfway across the world? And you say, what? No. And then that's one way that they may capture that. But it doesn't always work.