Phishing posing as X notices harvests login details and authentication codes
A phishing campaign was identified that impersonated X notices about policy violations, copyright, and appeals to collect users' login credentials and one-time two-factor authentication codes and take over their accounts. X won a dispute over 40 related domains and obtained an order for their transfer.
Key facts
- Affected organization
- X
- Incident type
- Phishing & smishing
- Occurred / detected
- Not confirmed
- Scale of damage
- 40 phishing-related domains identified and user accounts taken over
- Cause / method
- Phishing impersonating X notices to collect login credentials and one-time two-factor authentication codes
- Location
- United States
If your data was exposed
Exposed dataUsernamePassword
- Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
Timeline
- Account-takeover phishing impersonating X notices was identified, and it emerged that X had obtained an order to transfer 40 related domains.
1 related reports
Other incidents at X
Alleged leak of personal data of 200 million X users
200MImpact: Alleged leak of personal information of about 200 million users
Allegations emerged of a leak of personal information affecting more than 200 million X users. Hackers were also claimed to have distributed 2.9 billion records related to Twitter/X users, while it was also explained that the data was public information. Later, a leak of about 200 million social media records was also reported.
Related reports: 11 · last report →Massive X outages amid DDoS attack claims
Impact: Multiple service outages and user login problems
On March 10, 2025, X suffered multiple service outages and user login problems. Elon Musk blamed a massive cyberattack, and Dark Storm claimed to have carried out a DDoS attack. Experts questioned Musk's claim that the attack was linked to Ukraine.
Related reports: 11 · last report →X's Trump-Musk livestream glitches and DDoS claim
Impact: Access problems with the Trump-Musk live conversation
Donald Trump and Elon Musk's live conversation on X suffered access problems and technical issues. Musk claimed a massive DDoS attack was the cause. It is not known whether an attack was confirmed.
Related reports: 8 · last report →9.4GB of Twitter data leaked online, exposing 200 million records
200MImpact: 9.4GB of data, 200 million records
9.4GB of Twitter data was leaked online, exposing 200 million records. The date of the incident and the response have not been confirmed.
Read on CyberSecurityNews ↗Hijacked celebrity Twitter accounts used in bitcoin scam
Impact: Twitter accounts of celebrities including Barack Obama hijacked
In 2020, the Twitter accounts of celebrities including Barack Obama were hacked and used in a bitcoin scam. In November 2025, a British hacker was ordered to return about $5.4 million in bitcoin.
Related reports: 4 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.