The social media platform formerly known as Twitter but rebranded as X since Elon Musk’s October 2022 acquisition might ‘only’ have around 600 million active monthly users, compared with the three billion that Facebook attracts, but that doesn’t mean it’s not on the cybercriminal radar. I’m not talking about X accounts being hijacked due to password reuse and compromise, but rather the ongoing, commonplace use of so-called warnings that appear to be from the platform itself but are actually phishing attacks. These are not new, of course, and I have reported on supposed breach of community guidelines notifications circulating in May, and copyright breach notifications before that. The latest attacks, as reported by The Guardian, involve the use of what have been described as being “almost an exact replica of legitimate login notifications sent by X,” down to the formatting, colors, logo and content. They warn of a successful login coming from a new device and include the location; both of which will be news to the recipient, and so encourage a knee-jerk response to ensure their account can be locked down and recovered from a potential hacker. The truth, however, is that by following the links to change a password or confirm app access, the user will become a victim of the precise type of attack they think they are preventing.
X’s Login Alerts Replicated Almost Pixel For Pixel
Darren Guccione, CEO of Keeper Security, told me that this latest phishing campaign shows how far attackers have come in manufacturing legitimacy as far as attacks on X users are concerned. “The emails replicate X’s login alerts almost pixel for pixel,” Guccione said, with the sender address and where the embedded link actually leads being “easy to miss under pressure.” And, of course, there is pressure aplenty: “We noticed a login to your account from a new device. Was this you?” is where the stress begins, and the time-sensitive pressure builds with the attention-grabbing “If this wasn’t you, complete these steps now to protect your account” link.
For X users and anyone else on the receiving end of a login warning alert, the advice is simple: never click a login link from inside an email, text message or notification. “Open the platform directly and treat any password request arriving by email or direct message as fraudulent by default,” Guccione advised. X itself confirmed that “X will never send emails with attachments or request your X password by email.”