Loading story…
X (formerly Twitter) has mandated that all users relying on hardware security keys or passkeys for two-factor authentication (2FA) must re-enroll their credentials by November 10. This requirement is driven by the platform's transition from the twitter.com domain to x.com, which affects how security keys are cryptographically tied to web domains. Security keys registered under twitter.com will not function for authentication on x.com, necessitating the re-enrollment process to maintain account access.
The company clarified that this change is not related to any security breach or incident, but is a technical necessity due to the domain migration. Only users utilizing physical security keys or passkeys are impacted; other 2FA methods such as authenticator apps or SMS codes remain unaffected. Users who do not re-enroll their security keys by the deadline risk being locked out of their accounts until they update their credentials or switch to another authentication method. X emphasized that this move also aligns with its broader commitment to modern authentication standards and the eventual retirement of the Twitter brand and domain.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
November 10, 2025 was the cutoff date X gave users to re-enroll their passkeys and hardware security keys before risking being locked out of their accounts.
In follow-up reporting, X stated the passkey reset requirement was caused by the shutdown of twitter.com rather than any security problem or breach. This clarified the reason for the re-enrollment request as an infrastructure/domain transition.
X warned users that as it retires the legacy twitter.com domain, they must re-register passkeys and hardware security keys used for two-factor authentication to avoid account access issues. The company set November 10, 2025 as the deadline for re-enrollment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcego.theregister.com
Open sourcehackread.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft announced a major authentication overhaul for **Microsoft Entra ID** in the public cloud, making **passkeys** the default sign-in experience starting **September 1, 2026** and shifting customers away from phishable SMS and voice-based multifactor authentication. The company said users who still rely on SMS or voice MFA will be automatically prompted to register passkeys during MFA flows, and organizations will not be able to opt out of those registration prompts. Microsoft tied the move to rising phishing risk, including AI-assisted campaigns, and said passkeys provide stronger protection through public-key cryptography rather than shared secrets. Microsoft will also retire its native telecom delivery for SMS and voice authentication, with customers that still need those methods for regulatory or technical reasons required to use supported third-party telecom providers through the **Microsoft Security Store**. Administrator configuration for supported providers is scheduled to begin on **October 30, 2026**, with additional provider details and deployment guidance due earlier, while mandatory passkey registration for users dependent on SMS or voice is set to begin **February 1, 2027**. Reactions from administrators were mixed but largely unsurprised, with some citing prior SIM-cloning account compromises and others warning that the migration timeline is tight even as they accelerate user education on passkeys.
Sep 5, 2026
Twitter faced a high-profile account takeover that compromised prominent accounts and triggered a federal investigation led by the **FBI**, according to Reuters. The incident raised concerns about how attackers accessed internal tools and used them to hijack verified profiles, turning the breach into a major national cybersecurity and platform-trust issue. In the aftermath, Twitter rolled out security changes aimed at hardening internal access, including requiring **security keys** for employees to reduce the risk of similar compromises. The response highlighted the role of employee-access protections and privileged-tool controls in defending social media platforms against attacks that can rapidly spread fraud, disinformation, and reputational damage.
Jul 12, 2026
Microsoft is making passkeys the default authentication experience for Microsoft Entra ID public-cloud users beginning **September 1, 2026** and will retire Microsoft-provided SMS and voice authentication. SMS first-factor sign-in and native Microsoft SMS/voice capabilities for workforce tenants will end on **February 1, 2027**; Global Administrators and external users have until **July 1, 2027**. SMS first-factor authentication has already been retired for Entra ID Free tenants. Organizations must migrate affected users to phishing-resistant authentication to avoid sign-in disruptions. Users relying only on Microsoft-provided SMS or voice will have to register a passkey before they can sign in after the applicable deadline, with no opt-out from enforcement; a temporary opt-out only defers the initial passkey-default rollout until February 1, 2027. Microsoft also supports QR-code authentication, FIDO2 security keys, and other Entra methods, while organizations needing SMS or voice must use a supported customer-managed telecom provider through the Microsoft Security Store.
Sep 23, 2026