Twitter: Employees Compromised in Phone Spear-Phishing Attack

The attack earlier this month started with a spear-phishing attack targeting Twitter employees, the company says in a new update.

Twitter today published a new update on its recent security incident, confirming a small number of employees were targeted in a phone spear-phishing attack. The intruders were able to use their credentials to tweet from celebrity accounts, access direct messages, and download data.
The attack, which
took place
earlier this month and involved the takeover of several high-profile Twitter accounts, raised concerns over Twitters internal controls and the
level of access
its employees have to high-profile accounts. The company has since published multiple updates on its ongoing investigation and the steps its taking to improve account and employee security.
This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems, Twitter said in an update published yesterday.
A successful attack required access to both Twitters internal network and employee
credentials
to specific support tools. Not all employees initially targeted had permissions to use account management tools, but the attackers used their credentials to access internal systems and gain information about its processes. This enabled the attackers to target 130 Twitter accounts and tweet from 45, access the DM inboxes of 36, and download the Twitter data of seven.
In addition to confirming the mobile spear-phishing attack vector, Twitter claims it has significantly limited access to its internal tools and systems while its investigation continues. Some processes and features -- in particular, access to the Your Twitter Data download feature -- have been affected. The company says it may be slower in response to account support needs, reported tweets, and applications to its developer platform.
Read more details in Twitters
full update
.

Register now for this years fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on
conference information
and
to register
.

Last News
▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Twitter: Employees Compromised in Phone Spear-Phishing Attack