X Users Targeted by Unsolicited Password Reset Emails Amid X Money Launch

Users of X have been inundated with unsolicited password reset emails, prompting fears of a potential security breach. Mridul Singhai, a member of X’s Product Engineering team, confirmed that the company is investigating the situation but has not found any evidence of compromised systems.

The unsolicited emails began circulating shortly after the launch of X Money, a service that allows Premium and Premium+ subscribers in the U.S. to send money to one another using the banking infrastructure of Cross River Bank. Singhai noted that attackers seem to believe that the wider availability of X Money could facilitate unauthorized access to user accounts.

Reports indicate that multiple users received several password reset emails in quick succession, even though they did not initiate any requests. Singhai advised users to enable two-factor authentication and the “Password reset protect” feature to enhance their account security. He also cautioned against clicking any links in the emails.

This incident follows a history of security challenges for X, with previous attacks involving internal exploitation. In contrast, the current situation appears to involve external actors targeting public usernames through X’s recovery form.

Recommendations for Users

• Enable two-factor authentication (2FA).
• Activate the Password reset protect feature.
• Do not click on any links in unsolicited emails.

As X continues its investigation, users are urged to take proactive measures to secure their accounts.