first of all i dont use instagram so i cannot guarantee what i have said. however i do have a fair bit of roblox experience and account stealing kinda happens all the time there.

if the ad links to a website, it could steal session details. most sites have a “remember me” feature so that you dont have to login every time you visit it. the server does this by giving your computer a unique identifier after you log in, so now that identifier can be used instead of a username and password. the website could steal that identifier and thus impersonate you, without getting your username and password.

after doing this basically anything could happen, but most likely the account will be controlled by a bot to spread the ad further, eventually amassing some sort of botnet.

in theory stopping the bot from accessing your account could be as simple as logging out of all devices the moment you fall for it, but im not too sure what would happen if you do it any later than that.