In recent times, the social media platform X, formerly known as Twitter, has seen a surge in cryptocurrency scams targeting verified accounts. These accounts, marked by ‘gold’ and ‘grey’ checkmarks, signify official organizations and government entities, respectively, and are generally trusted by the platform’s users.
Despite security measures like two-factor authentication, hackers have managed to compromise high-profile accounts, such as that of Mandiant, a Google subsidiary, to promote fraudulent airdrop scams.
The issue has escalated with reports of verified accounts being sold on the black market, with prices ranging from $1,200 to $2,000, as detailed by CloudSEK.
Understanding the Verification System on X (Twitter)
The verification system on X is designed to help users identify authentic accounts of public interest. To receive the coveted blue checkmark, accounts must be actively subscribed to X Premium and meet specific eligibility requirements, which include having a complete profile, recent activity, a confirmed phone number, and adherence to non-deceptive practices. More information on the verification process can be found on Twitter’s help center.
The platform also differentiates between gold, grey, and blue checkmarks, each representing a different type of verified account, as described in Twitter’s profile labels policy.
- Blue Badge – A blue badge signifies that an account possesses a current membership with X Premium and aligns with our stipulated eligibility criteria.
- Gold Checkmark and square avatar – The gold check denotes that the account is recognized as an authentic institutional account under the Verified Organizations program.
- Grey Checkmark – The grey check signals that an account is associated with an agency or entity of a governmental or multilateral nature, or an individual holding an official position within such an organization.
Recent Incidents of Account Hijacking
In a sophisticated cyberattack, the Twitter accounts of several notable figures, including former President Barack Obama, President Joe Biden, tech moguls Jeff Bezos and Elon Musk, as well as philanthropist Bill Gates, were compromised. This breach was not just aimed at promoting a cryptocurrency scam, but it also inadvertently highlighted the vulnerability of social media influence, underscoring the risks associated with strategies to artificially inflate one’s online presence, such as the temptation to buy X followers. The attackers employed a strategy to dupe the followers of these accounts into sending Bitcoin, with the false promise of receiving double the amount in return, revealing the dark side of manipulating social media metrics for perceived credibility and reach.
The attack was not limited to individuals; major companies and cryptocurrency platforms such as Apple, Bitcoin, CashApp, Coindesk, Coinbase, and Uber also saw their accounts breached. The fraudulent posts quickly spread across the platform, with some, like the one from Bill Gates’ account, offering to send back $2,000 for every $1,000 sent to a specified Bitcoin address. Elon Musk’s account similarly enticed followers with the prospect of doubling their Bitcoin payment if sent within a specified time frame. While some account owners were able to reclaim their accounts and delete the fraudulent tweets, the scam reached a vast audience before it could be contained.
For more details on the incident, visit Dark Reading’s report.
Mandiant’s Twitter Account Recovery After Crypto Scam Attempt
The cybersecurity firm Mandiant also fell victim to a Twitter account hijacking, which saw their ‘Mandiant X’ account commandeered in an attempt to perpetrate a cryptocurrency theft. The firm acknowledged the breach and informed the public that they had launched a full investigation into the matter. Fortunately, control over the account was swiftly regained, and normalcy was restored.
The company’s spokesperson addressed the incident, assuring that the account was secure once again and that they were taking steps to prevent future occurrences. The event underscores the persistent threat of social media account hijacking, particularly with the intent of carrying out financial scams.
For a detailed account of Mandiant’s response to the hack, refer to the coverage by The Register.
Methods Used by Hackers
Hackers have employed various techniques to bypass two-factor authentication and gain unauthorized access to verified Twitter accounts. These methods range from exploiting security weaknesses to social engineering attacks, as evidenced by the large-scale hack that took place in July 2020.
Impact on Victims and Followers
The impact on businesses and individuals can be significant, with nearly half of the crypto losses since 2021 originating from social media platforms, as reported by Status Labs.
Given Twitter’s standing as a leading social media network, the breach of such an account can lead to significant privacy concerns. Unauthorized users gaining entry to your account can potentially gain insight into personal details linked to it, including but not limited to your contact number.
Preventative Measures and Security Recommendations
To secure Twitter accounts, it is crucial to use strong, unique passwords, enable two-factor authentication, and be vigilant about suspicious links and ads. Twitter’s account security tips and MakeUseOf’s guide provide comprehensive advice on protecting social media accounts.
The Black Market for Verified Accounts
On the shadowy corners of the internet, a burgeoning trade in social media accounts is taking place. Notably, a proliferation of offers for Twitter accounts with premium Gold verification has been spotted on both the dark web and Telegram. These listings suggest an uptick in nefarious operations that utilize such verified accounts.
Price Analysis of Listed Accounts:
- Basic, newly created accounts are sold for as little as $0.30 each.
- New accounts with a coveted Blue Tick can go for an average of $35.
- Accounts aged over five years are priced at about $1.5.
- Older accounts upgraded to Gold status fetch between $1200 and $2000.
- Adding Blue or Gold affiliation to an account costs an additional $150 and $500 respectively.
The high-value nature of these transactions has given rise to a secondary market of intermediaries who guarantee the legitimacy of the deals. Moreover, these accounts are often sold multiple times, indicating a thriving reseller ecosystem.
Key Findings from Online Advertisements:
- One seller claimed to offer 15 inactive accounts weekly at $35 each, which could be upgraded by the buyer, amounting to over 720 accounts per year.
- Some ads specified the brands associated with the accounts for sale, with prices reflecting the account’s brand value and follower count.
- Transactions typically involve a middleman to validate the exchange.
- Sellers may also inflate the follower count of an account by up to 50,000 for an additional fee.
- Buyers can add a number of affiliates to a Gold account at no cost, but beyond a certain point, each new affiliate incurs a $50 charge.
The detailed analysis of this illicit trade can be found in CloudSEK’s whitepaper on the subject.
Official Responses and Measures by X (Twitter)
Twitter has outlined steps for users to take if they suspect their account has been compromised, including changing passwords, revoking third-party app access, and contacting support.
- Change your password immediately. Do this through the settings if logged in, or use the ‘Forgot Password’ feature if logged out. Ensure the new password is strong and unique.
- Secure your email address linked to your account, ensuring you’re the only one with access. You can change it via the app or website.
- Revoke access to any unrecognized third-party applications through the settings.
- Update your password in any trusted third-party applications that use it.
- Contact Support if you cannot resolve the issue after these steps, using the email associated with your compromised account and providing your username and last access date.
Take extra precautions by deleting any unwanted posts, scanning for malware, installing updates, using strong passwords, considering two-factor authentication, and not sharing login credentials.
The platform’s financial scam policy, detailed on Twitter’s help center, aims to combat fraudulent activities by imposing strict consequences on violators.
Legal and Regulatory Considerations
Legal action has been taken against individuals involved in Twitter account hacking, as seen in the July 15, 2020, Twitter hack. The U.S. Department of Justice has charged three individuals with various offenses related to the incident.
Three individuals have been charged for their involvement in the July 15, 2020, Twitter hack, which compromised approximately 130 accounts of high-profile figures. Mason Sheppard of the UK faces charges including conspiracy to commit wire fraud and money laundering. Nima Fazeli of Florida is charged with aiding and abetting computer intrusion. A juvenile was also implicated but proceedings remain sealed under federal law.
Case Studies and Statistics
Social media account hacking is a growing concern, with platforms like Facebook and Instagram being prime targets. On average, 1.4 billion social media accounts are hacked each month, with a 1000% increase in hijacked accounts from 2021 to 2022. It is estimated that 20% of social media accounts will eventually be compromised.
Both individuals and large corporations are vulnerable to social media hacking. Facebook and Instagram are particularly prone to attacks, and there is a high volume of Google searches from users seeking help for hacked accounts. Major data breaches have also hit Facebook and LinkedIn, affecting millions.
The healthcare sector and big corporations are common hacking targets, while government agencies are less often attacked through social media. High-profile Twitter accounts have been hacked as well. The origins of these attacks are often linked to countries like China, Russia, Brazil, Vietnam, and the Netherlands. On the dark web, social media account data can be purchased for as little as $6.
These cyberattacks have serious financial consequences, with an estimated loss of $3.25 billion. Meta has faced criticism for poor customer support, with many users unable to regain access to their accounts. Some cybersecurity firms now offer recovery services for hacked accounts. Privacy concerns and fear of attacks have led 11% of users to delete their social media accounts. In 2021, social media scams cost Americans over $770 million.
Source: These statistics on social media hacking, provided by StationX, illustrate the scope of the problem and its consequences, including financial losses and compromised privacy.
Conclusion
In conclusion, the issue of verified X accounts being targeted in crypto scams is a complex and multi-faceted problem that requires a concerted effort from platform operators, users, and law enforcement to address. By understanding the verification system, being aware of recent incidents, employing robust security measures, and staying informed about the black market and legal actions, stakeholders can work towards mitigating the risks associated with social media account hacking.
EN 
TR