Symantec says that the app was downloaded between 100,000 and 500,000 times from the Google Play store. Reuters

The quest for additional likes and followers came at a hefty price for thousands of unwary Instagram users.

According to Symantec experts speaking with Mashable, it is estimated that 100,000 users have fallen for a questionable app called InstLike. The app directed users to hand over their Instagram login password and username, promising increased followers and likes to people who bought virtual coins. The scammers would then be able to increase the followers and likes associated with accounts that purchased the app since they had access to all the accounts who provided their user names and passwords. They would simply use those login credentials to enter the users and accounts and follow other Instagram users. Thus, as more customers provided their login information, the operators could offer app purchasers more followers through InstLike.

One hundred coins on the site cost $1, and users were allocated 20 free digital coins each day. One "like" cost one coin while one follower cost 20 coins. So the app was basically free until users ran out of their daily coin allowance and wanted more.

Both the Android Google Play store and iOS App Store hosted the app – between June 9 and Oct. 25 for the Google store and between Sept. 19 and Nov. 7 for the Apple store. Symantec estimates that at least 100,000 users fell victim to the app since it was downloaded between 100,000 and 500,000 times from the Google Play store. But they do admit that the actual number of affected users could be a lot higher.

The app has been removed from both the Google and Apple app stores. But the InstLike website is still functioning. Victims of the scam are being encouraged to change their Instagram passwords.