Major Influencer Twitter Breaches

On 15 July 2020, multiple high-follower and influential Twitter accounts started posting strange messages about a cryptocurrency giveaway. There were a number of posts made by celebrities and influencers involved in cryptocurrency, politics, and tech. Alpha Team immediately began tracking the posts, the bitcoin wallets and the website that the attackers used in this coordinated attack.

Recommendations

Authenticate your organization's Twitter accounts with ZeroFOX and enable Hacked Account Post, which now contains bitcoin addresses and other indicators of compromises from the hacked posts related to this attack
Review the whitelist of Twitter applications on ZeroFOX. Enable the Unauthorized Application rule which will catch any posts made from applications not authorized to post on your behalf
Work with your ZeroFOX Account Manager and Platform Specialists to ensure authenticated protection of all of your social accounts

Details

On 15 July 2020, around 1630 EDT, multiple cryptocurrency exchanges and influencers started making posts directing users to a crypto-giveaway scam website.

Influencer accounts peddling crypto-giveaway scam

The initial rumor was that an admin panel belonging to a Twitter employee was hacked. Multiple “OG” trading forums and chatrooms, which specialize in account takeover, were chatting about the hack during it, and some warned to not do anything until the situation blew over:

User warning a Discord to not purchase any Twitter accounts

The initial posts contained a domain, cryptoforhealth[.]com, had text similar to many other crypto giveaway scams, as documented by Alpha Team:

Screenshot of the cryptoforhealth website

The site is now down. It was originally hosted on Cloudflare, and the origin IP address was hosted on 111.90.149.224 via Shinjuri Technology. Cloudflare quickly took the site down.

Shortly after, a new wave of posts started, which directed users to a Bitcoin wallet address directly in the tweet body. Below are tweets from President Barack Obama, Vice President Joe Biden and Elon Musk, who’s accounts fell victim to the attack.

President Barack Obama tweeting the wallet address for the scam

Vice President Joe Biden tweeting the wallet address for the scam

Elon Musk tweeting the wallet address for the scam

Victims started sending Bitcoin to this address, and as of 1900 EDT on 15 July 2020, the address has made 12.81 BTC, close to $120,000 USD. Other bitcoin addresses were also posted after this, and are included in the “indicators of compromise” section at the end.

At 1745 EDT, Twitter Support tweeted out that they are investigating the incident, and then subsequently mentioned that some users may not be able to tweet or reset their password.

Twitter Support acknowledging the incident

After 1800 EDT, the tweets seemed to stop for the most part, especially for verified accounts. This could be what Twitter Support was alluding to when they said some accounts could not tweet, as a number of verified accounts reported that they could not tweet after this announcement.

Indicators of Compromise

38qyALcxSnfzaFFTnt46xHMTN3GCGanKXC
rhYSX8qSpoU7Dwjh6vMSuACu8MBECn6bQR
Bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh
cryptoforhealth.com
111.90.149.224