The most common attacks on X accounts, and how to block each one

Most X accounts aren't lost to clever hacking. They're lost to a convincing message, a password that was already leaked somewhere else, or a phone number that someone talked a carrier into moving. The six patterns below cover the large majority of takeovers. For each one we explain what it looks like from your side of the screen and which setting or habit stops it.

1. Phishing DMs and emails

The classic version is a direct message or email that looks official and has a deadline. Your account "has been flagged," "will be suspended in 24 hours," or "is eligible for a badge." There's a link, and the link leads to a page that looks like the X login screen.

Anything you type there goes straight to the attacker. Better kits also ask for your two-factor code on the next screen and pass it to the real X within seconds, so an authenticator app alone doesn't save you if you play along.

What stops it:

• Never log in from a link someone sent you. Open the X app or type x.com yourself and look for the notice there. Real account problems show up inside the app.
• Use a security key or passkey. They are tied to the real domain, so a fake site can't use them even if you're fooled.
• A password manager helps quietly here too: it won't offer to fill your X password on a domain that isn't X.

Paste any link you're unsure about into the link explainer. It shows the real domain and flags the usual tricks.

2. Fake copyright and verification notices

These are phishing with a specific script, and they deserve their own entry because they work so well on creators and brands. The copyright version claims someone has filed a complaint against one of your posts and offers an "appeal form." The verification version says your checkmark will be removed unless you confirm your details, or offers a gold or gray badge for a fee.

The appeal form is a login page. Sometimes it also asks for your email password "to confirm ownership," which hands over the account and the way back into it.

The tells are consistent: a sender who isn't an official X account, a domain that only resembles X (x-support-team, twitter-appeals, copyright-x and so on), and urgency measured in hours. Copyright complaints on X are handled through X's own notices, not through a DM from a stranger with a Google Form. See our guide to fake support accounts for how to tell the real ones apart.

3. SIM swap

In a SIM swap, the attacker convinces your mobile carrier, often with personal details found online, to move your number to a SIM card they control. From then on, every text message meant for you goes to them, including password reset codes and SMS two-factor codes.

The first sign is usually your phone suddenly showing no service. By then they may already be resetting accounts.

What stops it:

• Don't rely on SMS for X. Switch to an authenticator app, security key or passkey. X has offered text-message two-factor only to X Premium subscribers since March 2023, and even for them it's the weakest option.
• Ask your carrier for a port-out PIN or number lock. Most carriers offer one in the account settings or over the phone.
• Remove the phone number from your X account if you don't need it, and turn off the option that lets people find you by phone number.

4. Session token theft

When you log in, X gives your browser a session cookie that keeps you signed in. If malware copies that cookie, the attacker can load your account in their own browser without your password and without a two-factor prompt. This is why some people get "hacked" with strong passwords and a security key in place.

The cookie thieves are usually information-stealing malware. It arrives in a cracked app, a pirated game, a fake "media kit" or brand deal attachment, a bogus video editor, or a browser extension that asks for far more access than it needs.

What stops it:

• Don't install cracked software or random downloads on the machine you use for X, and be wary of files sent as part of a "sponsorship" pitch.
• Keep your browser and operating system updated and trim your extensions.
• Check your active sessions now and then. Logging out a session ends it on X's side, so a stolen cookie for it stops working. After a password change, check the list again to make sure nothing unfamiliar is still there.

5. Malicious connected apps

X lets third-party apps act on your account through authorized access. That's how scheduling tools and analytics dashboards work. It is also how a quiz, "who unfollowed you" checker or free follower tool can end up posting spam from your account or reading your DMs. Authorizing an app doesn't share your password, so changing your password alone may not cut it off.

Read the permission screen before you click Authorize. If a toy app wants to post, follow accounts and read direct messages, close the window. Every few months, open the list of connected apps and revoke anything you don't use.

6. Crypto giveaway and wallet drainer scams

This one is usually the result of the attacks above rather than a way in. Once someone controls an account with a real following, they use it. Typical moves: change the name and photo to impersonate a crypto project or celebrity, pin a post about a token launch or airdrop, and link to a site that asks visitors to "connect wallet." Signing the request lets the site drain the wallet.

For you as the account owner, the defense is everything above. For you as a reader, the rules are short. Nobody legitimate doubles your crypto, a verified badge on a hijacked account still looks verified, and any site that asks you to connect a wallet to claim something free should be closed. If an account you follow suddenly turns into a token promoter, assume it's been taken over and warn the owner through another channel.

Where to start

If you only do three things this week, do these: turn on a phishing-resistant second factor, check your sessions and connected apps, and make sure the email address on your account has its own strong password and two-factor. The security check on our homepage walks through the rest and gives you a printable list.

Questions

TweetAttacks is independent and not affiliated with X Corp. Settings names can change when X updates its apps; if a menu has moved, search its name in X's settings.