Wave of X password reset emails could be hiding a sneak phishing attack

X users have started receiving numerous password reset confirmation emails, potentially indicating a covert phishing campaign. Although no breaches have been reported yet, the barrage of emails could be concealing a secondary attack. X product engineer Mridul Singhai acknowledged the flood of password reset emails, stating that attackers may believe the new X Money service makes it easier to gain unauthorized access to accounts.

X is actively investigating the issue, finding no evidence of breaches so far. This comes as X launched X Money in July, a financial service for users with paid X Premium or Premium+ accounts. The legal and security teams at X will find and hold accountable anyone attempting to harm users, said X's general counsel James Burnham.

Receiving a password reset email doesn't indicate a compromised account, as such emails are a common multi-factor authentication mechanism. However, unsolicited password reset emails do suggest an attempted account access. While these notifications aren't immediately dangerous, hackers may use them to hide actual phishing emails.

These phishing emails prompt users to change their passwords and provide a fake X link, aiming to trick users into giving away their login credentials. While X hasn't confirmed this phishing tactic, Singhai suggested users check if emails from X come from x.com and have a blue BIMI check mark. To stay safe, hover over links to verify their destination or avoid clicking them entirely.

Instead, change passwords by directly accessing X via its app or typing its URL into a web browser. Be wary of urgent messages, as hackers may try to rush users into providing information hastily.