Loading story…
X is investigating a large-scale attempt to access user accounts through its password-recovery workflow, in which attackers used public usernames to trigger unsolicited password-reset emails. The activity emerged after the broad launch of X Money, the platform’s payments service, and reportedly targeted hundreds of thousands of users.
X said it disrupted the campaign and had found no evidence of successful breaches, mass account takeovers, or account compromises. The U.S. Department of Justice is working with X to identify the sophisticated cybercriminals involved; users are advised to enable two-factor authentication while X’s security and legal teams pursue the operators.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
X said it was investigating unsolicited password-reset emails sent to numerous users, which attackers appeared to trigger at scale using public usernames in an attempt to gain unauthorized account access after X Money's broad launch. X reported no evidence of successful breaches or mass account takeovers and advised users to enable two-factor authentication.
U.S. Attorney General Todd Blanche said sophisticated cybercriminals targeted hundreds of thousands of X users through the platform's password-recovery process and that X disrupted the attempt. The U.S. Department of Justice began working with X to identify those responsible; no successful compromises or attribution were disclosed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcecyberveille.ch
Open sourceteiss.co.uk
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026
Meta disclosed that attackers exploited a flaw in its AI-assisted Instagram account recovery system, known as **High Touch Support (HTS)**, to reset passwords for accounts they did not own. Reporting tied the abuse to earlier takeovers of high-profile and valuable accounts including the archived Obama White House profile, Jane Manchun Wong, Sephora, a senior U.S. Space Force official, and sought-after short handles such as `@hey` and `@jowo`, some of which were briefly defaced or advertised for resale on Telegram. Multiple reports said attackers used VPNs or residential proxies to appear near a victim’s usual location, then manipulated Meta’s support workflow to add an attacker-controlled email address or receive a reset link without compromising the victim’s inbox. Meta later said the vulnerable code path failed to verify that the submitted recovery email matched the email already associated with the target account, exposing **20,225** users between roughly April 17 and the end of May; successful takeovers were generally possible when victims had not enabled two-factor authentication. The company said it discovered the exploitation on May 31, disabled the HTS tool, invalidated reset links, forced affected accounts through security checkpoints and password resets, and plans to notify impacted users while reviewing similar recovery flows across its platforms. The incident drew broader scrutiny because an AI-driven support layer was allowed to perform privileged identity and recovery actions without deterministic verification, turning customer support into an account-takeover path.
Jul 30, 2026
Attackers gained unauthorized access to Microsoft’s official `@Microsoft` X account, which has more than 13 million followers, and used it to promote a purported `$Clippy` cryptocurrency in an apparent pump-and-dump scheme. The account’s profile image was changed to Clippy and it followed and reposted material from `@clippymsftcto`, an impersonation account that falsely claimed the token’s liquidity pool was tied directly to `$MSFT`; the impersonator was later suspended. Microsoft removed the unauthorized content, secured the account, disavowed any cryptocurrency affiliation, and said it is investigating the compromise and will pursue legal action over misuse of its brands and intellectual property. The intrusion method remains unconfirmed; potential avenues cited include phishing, SIM swapping, a compromised recovery email, infostealer-stolen session cookies, or compromised authorized social-media tooling. The incident follows the June 2024 takeover of Microsoft India’s X account, which was used to distribute a cryptocurrency wallet-drainer lure.
Oct 2, 2026