I see a lot of these too. They take over regular people's accounts, e.g. people from school I still follow, probably brute forcing passwords, then they post all this content how they are self made off crypto but the person in the videos doing the prostelyzation is in no way shape or form the same person who previously held the account.

Clearly they do this to get a decent follower count initially for their spam bots, but my word is anyone who follows John Doe actually going to believe a scam video that is clearly not John Doe coming from John Doe's account claiming to be him? There has to be more effective angles.

I would hope that Instagram has some counter-measures to prevent brute-forcing, at least restricting the number of failed login attempts.

It might be instead that your friends re-used a password that was leaked/stolen from somewhere else; anyone with a non-trivial number of online accounts using the same email will be listed in multiple leaks on aggregators like https://haveibeenpwned.com/.

Part of it is they're just looking for the lowest hanging suckers that won't notice, easier victims mean less wasted effort on someone who might bite initially but won't convert into real cash. Also I'm betting it's to legitimize their existing spam accounts with follows from (formerly) authentic users.