Pavel Zhovner

Last night my Twitter account was hijacked. I’ve now regained access and can tell the full story — it was a sophisticated phishing attack. Essentially, I handed over all my passwords and 2FA myself, so it’s entirely my fault. 1. I received an email (screenshot) claiming there was a content violation report. Since I occasionally get such emails, I instinctively clicked the link. 2. The domain looked very close to the real x[.]com, and I didn’t notice anything suspicious. The email didn’t go to spam and wasn’t flagged as suspicious. 3. I followed the link and, without thinking, entered both my password and 2FA — all in one click via my password manager. The trick was that although the domain was fake and didn’t recognized by password manager, I manually selected my Twitter credentials, thinking the appeal panel might use a subdomain. After that, scammers spent the whole day posting crypto scam content from my name. They created a token called “flipper” through the @believeapp and some website selling crypto garbage. We tried to quickly ban the domains they were creating. Lesson learned: I was careless — sick and clicking links at 2am. Let this be a warning for others.