The Twitter account hijack (2020)

What happened

On July 15, 2020, many of the most-followed accounts on Twitter (now called X) suddenly posted near-identical messages. Accounts belonging to well-known business leaders, celebrities and major companies all promised to double any bitcoin sent to a particular address. It was a scam, and some followers sent money before Twitter could stop it. Investigators later reported that the scam addresses received more than $100,000 in bitcoin.

Twitter took the unusual step of temporarily preventing many verified accounts from posting while it regained control. In its own summary, the company said attackers targeted 130 accounts, posted tweets from 45 of them, accessed the direct messages of 36 and downloaded the account data of 7.

How it worked

No software vulnerability was needed. The attack was a textbook case of social engineering:

1. Research. The attackers learned about Twitter employees and its internal processes, including who had access to account support tools.
2. Phone spear phishing. Posing as colleagues from the company's IT department, they called employees who were working remotely during the pandemic and persuaded some of them to enter their credentials on a fake internal login page.
3. Moving to privileged staff. The first employees they compromised did not have the access they wanted, so they used what they learned to target others who did.
4. Abusing internal tools. With access to the account administration tools, they could change the email address linked to accounts and take them over.

The intruders had first used the access to hijack and sell valuable short usernames before the high-profile scam. Several people were charged. The person described as the leader, a teenager in Florida at the time, pleaded guilty in 2021 and received a sentence that included time in juvenile custody.

Impact

Financially, the direct losses were modest. The bigger impact was trust: for a few hours, attackers could speak through the accounts of some of the world's most-followed people and organizations, on a platform used for breaking news and official announcements. A New York state financial regulator's investigation found that the attackers needed no special skills, and recommended stronger cybersecurity requirements for large social media companies.

What defenders learned

• Internal admin tools are crown jewels. Tools that can change any account must be limited to as few people as possible, protected by strong MFA, and closely monitored.
• Phishing-resistant authentication. Codes typed into a fake page can be relayed by attackers in real time. Hardware security keys and passkeys check the website's real address, which defeats this kind of fake login page. Twitter said afterwards it would expand their use.
• Remote work changes verification. When colleagues cannot walk over to each other's desks, a confident caller claiming to be from IT is harder to check. Clear call-back procedures help.
• Least privilege and logging. Fewer people with powerful access means fewer targets.

What it means for you

The same technique, a convincing phone call from "support", is used against ordinary people every day by fake bank fraud teams and fake tech support. Hang up and call the organization back using a number you find yourself. Never read out a one-time code, approve a login prompt or enter your password because a caller asked you to.

On your own accounts, prefer security keys or passkeys where available. And remember that even verified, famous accounts can be hijacked: an offer to double your crypto is a scam no matter who appears to post it.