X Under Siege: Password Reset Attack Targets Thousands

X, the social media platform formerly known as Twitter, is experiencing a major password reset attack. On Tuesday, numerous users reported receiving multiple password reset emails that they did not request. The emails are legitimate and come from X itself, but attackers have found a way to exploit the recovery form by using public usernames.

X has assured users that it has found no evidence of any breaches, but admits that the attack is likely motivated by the recent release of XMoney, which allows peer-to-peer payments for US Premium subscribers. With deposits insured up to $10 million at Cross River Bank, a stolen wallet can be emptied quickly.

X has provided guidance on how users can protect themselves from this type of attack, including enabling password reset protection and using two-factor authentication (2FA). Users are advised not to interact with the password reset emails and instead take steps to harden their accounts.

This is not the first time X has been targeted by attackers. In July 2020, employees were manipulated into handing over credentials, allowing attackers to access internal systems and steal $118,000 in Bitcoin.