Scammers Follow the Rebranding of Twitter to X, to Distribute Malware

Scammers exploited the media attention around Twitter’s rebrand to X by hijacking high-profile social accounts, renaming channels, livestreaming fake Elon Musk videos, and posting links to scam sites that distribute password‑stealing malware. Compromises began with emailed attachments containing password stealers that exfiltrated session cookies, allowing attackers to take over accounts and spread malicious download links and crypto scam pages. #Twitter #YouTube

Keypoints

Attackers leveraged Twitter’s rebranding to X as a social engineering lure and renamed compromised accounts to variations like “twitter-x” and “twitter fund.”
Initial access often came from spearphishing emails with attachments containing password‑stealing malware.
Executed password stealers harvested influencers’ session cookies (unique access tokens) and uploaded them to attacker‑controlled systems.
Stolen cookies were used as valid credentials to take over accounts, rename channels, and start livestreams impersonating Elon Musk to increase credibility.
Compromised accounts posted links to scam websites (notably twitter-x[.]org) and videos demonstrating how to download and run malware disguised as apps/games.
Scam sites included cryptocurrency payment addresses (ETH, BTC, USDT, DOGE) to collect funds from victims.
McAfee detected and blocked many of these malicious URLs via WebAdvisor and produced heatmaps highlighting scam URL and password‑stealer activity.

MITRE Techniques

[T1566.001] Spearphishing Attachment – Attackers delivered password‑stealing malware as email attachments to influencers. (‘password‑stealing malware as email attachments’)
[T1539] Steal Web Session Cookie – The malware extracted influencers’ session cookies (access tokens) and exfiltrated them to attacker systems. (‘the influencer’s session cookies (unique access tokens) are stolen and uploaded to attacker‑controlled systems’)
[T1078] Valid Accounts – Stolen session cookies were used to access and operate compromised social accounts (rename channels, livestream, post links). (‘After the influencer’s account has been compromised, the scammer starts to rename channels… then the scammers start to live stream’)
[T1204] User Execution – Victims were induced to download and execute files from compromised accounts/videos that instruct how to install malware disguised as legitimate software or games. (‘These videos demonstrate how to download and execute files, which are common password‑stealing malware’)

Indicators of Compromise

[Domain] Scam landing pages used for phishing/fake giveaways – twitter-x[.]org
[Crypto wallets] Payment addresses used by scam pages – 0xB1706fc3671115432eC9a997F802aC79CD7f378a, 1KtgaAjBETdcXiAdGsXJMePT4AEGWqtsug, and 2 more wallets

Attack flow: attackers first phish high‑profile targets (influencers) with spearphishing emails carrying password‑stealer attachments. When executed, the malware harvests browser session cookies and other credentials, then uploads them to attacker‑controlled infrastructure.

Account takeover and dissemination: stolen session cookies are used as valid account credentials to log into victims’ social accounts, rename channels (e.g., to impersonate corporate/CEO identities), and initiate livestreams that post chat links to scam pages. Compromised accounts also publish videos and screenshots instructing viewers how to download and run files that are actually password‑stealing malware, increasing spread via trusted channels.

Triage and remediation notes: defenders should block identified scam domains (e.g., twitter-x[.]org), monitor for unauthorized account name changes and unusual livestream activity on high‑subscriber channels, hunt for cookie exfiltration artifacts and suspicious outgoing connections from endpoints, and treat any downloaded executables from these campaigns as malicious. Maintain detection for spearphishing attachments and educate high‑value users to avoid executing unsolicited attachments.

Scammers Follow the Rebranding of Twitter to X, to Distribute Malware | McAfee Blog