X is investigating a wave of unsolicited password-reset emails and codes being sent to users, which may be attackers trying to take over accounts as X Money becomes more available. X says it has found no evidence of a breach or successful account takeovers so far, but warns the reset-email “flood” could also help scammers hide phishing attempts among legitimate messages.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
On September first, people on X started getting a wave of password‑reset emails and codes they never asked for. X says there’s no evidence of a breach or takeovers so far. This is classic reset flooding: attackers hammer the reset button to spam you, then slip in a fake email or DM saying, 'We saw unusual activity, click here or send us your code to secure your account.' Your red flags: you didn’t request a reset, but you’re flooded with emails or codes. Someone emails or messages you asking for that reset code or your 2FA code. They claim to be X support, security, or helping with X Money access. If you get an unexpected X password‑reset message, ignore the link and any request for codes, open the X app or type x.com yourself if you actually want to check or change your account.
Researchers found a turnkey scam kit sold on a cybercrime forum that lets criminals quickly stand up a fake crypto “presale” website styled to look like Tesla. The site uses pressure tactics and a fake investment dashboard to trick people into either handing over their wallet recovery phrase or…
Researchers and the FBI warn that criminals are luring World Cup fans to convincing fake FIFA ticket websites, often via social media ads and shared links. The scam steals payment details in real time during checkout, including card data and one-time passcodes (OTPs), while victims believe they are…
A wave of fake websites impersonates Calendly booking pages for “Meta Careers” job interviews. After victims select an interview time and complete a fake CAPTCHA, the site prompts them to log in to Facebook and then Google, capturing passwords and even two-factor authentication codes in real time.…
Researchers demonstrated how attackers can register lookalike web domains using two specific Unicode characters that Chromium-based browsers may display as trustworthy, normal-looking URLs. This can make phishing and typosquatting sites appear legitimate to employees, increasing the chance they…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
