Loading story…
Twitter faced a high-profile account takeover that compromised prominent accounts and triggered a federal investigation led by the FBI, according to Reuters. The incident raised concerns about how attackers accessed internal tools and used them to hijack verified profiles, turning the breach into a major national cybersecurity and platform-trust issue.
In the aftermath, Twitter rolled out security changes aimed at hardening internal access, including requiring security keys for employees to reduce the risk of similar compromises. The response highlighted the role of employee-access protections and privileged-tool controls in defending social media platforms against attacks that can rapidly spread fraud, disinformation, and reputational damage.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Hackers reportedly attacked Belarusian Railways in an effort to slow the movement of Russian troops through Belarus. The operation was described as politically motivated amid rising regional tensions involving Russia and Ukraine.
By late September, Twitter had implemented security improvements following the July attack, including requiring security keys for some employees. The company said it had tightened internal protections to reduce the risk of similar compromises.
U.S. federal authorities, led by the FBI, opened an investigation into the Twitter account compromise, according to Reuters reporting. The inquiry focused on how the attackers gained access and who was responsible.
Attackers took over prominent Twitter accounts in a large-scale breach and used them to post scam messages. The incident prompted an immediate security response and widespread concern over Twitter's internal controls.
Baltimore's municipal computer networks were disrupted by a ransomware attack that affected city services and internal systems. The incident left multiple government functions unavailable as officials worked to contain the damage.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
engadget.com
Open sourcereuters.com
Open sourceengadget.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Twitter suffered a major breach in which attackers hijacked prominent accounts including those of **Barack Obama, Joe Biden, Elon Musk, Bill Gates, and Jeff Bezos** and used them to post a Bitcoin-doubling scam. The fraudulent messages urged followers to send cryptocurrency to attacker-controlled wallets, exploiting the credibility and reach of the compromised accounts to amplify the fraud. Twitter said the intrusion stemmed from a **social engineering attack** against employees that gave the attackers access to internal administrative tools, while reports also raised the possibility that an insider may have been paid or otherwise assisted. In response, the company locked affected accounts and temporarily restricted all verified accounts from posting until it could restore access safely and contain the incident.
Aug 14, 2026
Twitter said attackers used social engineering against employees to gain access to internal tools, then targeted 130 accounts and successfully reset passwords, logged in to, and tweeted from 45 of them as part of a high-profile bitcoin scam. The takeover hit prominent accounts including those of Barack Obama, Joe Biden, Bill Gates, Jeff Bezos, Elon Musk, and Kanye West, while the company later disclosed that attackers also downloaded account data from eight users whose accounts were not verified. Twitter later confirmed the attackers accessed the direct-message inboxes of up to 36 targeted accounts, including one elected official in the Netherlands, reportedly Geert Wilders, though it said it had no evidence other current or former elected officials were similarly affected. As the FBI investigated and lawmakers pressed for answers, Coinbase said it blocked roughly 1,100 customers from sending funds to the scam wallet addresses, preventing more than **$280,000** in bitcoin transfers, although about 14 users still sent roughly **$3,000** before the blacklist took effect.
Jun 29, 2026
Attackers compromised Twitter employee access through a **coordinated social engineering campaign** and used the company’s internal account-management tools to seize control of numerous high-profile accounts, including those of **Barack Obama, Joe Biden, Bill Gates, Elon Musk, Jeff Bezos, Apple, Uber, and Warren Buffett**. The hijacked accounts posted fraudulent messages promising to double any bitcoin sent to an attacker-controlled wallet, which collected more than **$100,000** in cryptocurrency within hours. Twitter removed the tweets, locked affected accounts, and temporarily restricted posting and other functions for verified users as it investigated whether additional data, including direct messages or other account information, had been accessed. Reporting indicated the attackers may initially have been focused on hijacking coveted “OG” usernames and may have ties to the **OGUsers** gray-market forum, where access to Twitter accounts was allegedly advertised before the breach. Twitter said about **130 accounts** were targeted, though only a smaller subset was fully controlled, and the incident raised broader concerns because the platform is used by political leaders, major corporations, and financial markets; the **FBI** opened an investigation, lawmakers sought briefings, and Twitter shares fell in after-hours trading as the company worked to contain what was described as one of the most serious security failures in its history.
Jun 29, 2026