Following the recent rollout of X Money, the platform's new payments service, a wave of unsolicited password reset emails has hit users across Europe and beyond. X has acknowledged the issue, with its legal and security teams investigating what could be a coordinated phishing attempt.
X Money, which began as an invite-only service in July and expanded to all Premium and Premium+ subscribers on 31 August, allows users to hold funds, make and receive payments, and conduct peer-to-peer transfers directly on the platform. The financial nature of the service makes any potential account compromise particularly concerning.
James Burnham, X's general counsel, stated that "the legal and security teams @X will stop at nothing to identify, locate, and hold criminally accountable any person anywhere on or off earth who attempts to victimize our platform's users." This strong statement comes as users flood the platform to raise awareness and urge others to enable two-factor authentication.
Phishing campaign or isolated incident?
While receiving a password reset email does not automatically mean an account has been breached, especially with multi-factor authentication enabled, many users are worried that this could be the precursor to a larger phishing operation. Several users have reported receiving follow-up emails that appear to be from X, urging them to change their passwords. These emails contain links to fake X login pages, designed to steal credentials.
This multi-step approach suggests a more sophisticated hacking attempt than initially thought. The emails are crafted to look legitimate, adding to the confusion and fear among users. Security experts advise users to avoid clicking on links in such emails and to navigate directly to the official X website if they need to change their passwords.
The incident also raises broader questions about the security of new financial services on social media platforms. X Money relies on partner banks like Cross River Bank, which has faced regulatory enforcement actions in the past. The promotional 6% yield on deposits has also drawn scrutiny, as it is significantly higher than federal benchmarks.
This is not the first time that a new digital service has been targeted by phishing campaigns. Earlier this year, Meta's Muse Code launch was overshadowed by an AI hacking incident, highlighting the persistent threat landscape. Similarly, EU cybersecurity body confirmed state-backed hacking of officials' messaging apps, underscoring the seriousness of such attacks.
For European users, the incident serves as a reminder to remain vigilant. The European Union has been strengthening its cybersecurity regulations, but individual actions remain crucial. Enabling two-factor authentication, using unique passwords, and being cautious of unsolicited communications are essential steps.
As X continues to expand its financial services, the company will need to ensure robust security measures are in place to protect its users. The current investigation will likely shed more light on the scale of the attack and whether any accounts were actually compromised.
In the meantime, users are advised to monitor their accounts for any suspicious activity and to report any phishing attempts to the platform. The incident also highlights the importance of cybersecurity awareness, a topic that has gained prominence across the continent, especially after incidents like the Liechtenstein anti-money laundering register breach.
