Quarterly Threat Intelligence Report: Cyber Attacks in Q3 2024 – Key Insights, Trends, and Recommendations
© 2025 T-Sanct Technologies Pvt Ltd.
HOME | BLOGS | CATEGORY | The FalconFeeds X Account Takeover: How Hackers Bypassed MFA and Ran a Crypto Scam
On the evening of January 23, 2024, FalconFeeds.io—one of the most trusted names in cybersecurity threat intelligence—became the target of a sophisticated cyberattack. For over seven hours, our official X (formerly Twitter) account was under the control of cybercriminals, who used it to promote a fraudulent cryptocurrency giveaway. Despite having Multi-Factor Authentication (MFA) enabled, attackers managed to bypass security controls and post scam messages at an alarming rate. This attack was not an isolated event but part of a broader campaign targeting high-profile accounts. Here, we break down what happened, how it happened, and the critical lessons learned.
At 6:00 PM PST on January 23, 2024, FalconFeeds' X account was compromised. Within minutes, the attackers had full control, using the account to spread crypto scam messages.
During the attack window, over 400 scam posts were published, redirecting users to a malicious website: "mstr-x2-giveaway[.]com".
The attackers exploited vulnerabilities in the connected applications, particularly through unauthorized device tokens generated via "Twitter Web App (Twitter Inc)" and "Twitter for iPhone." Despite MFA, they managed to bypass security measures, likely using session hijacking or exploiting OAuth-related flaws.
The account email was changed multiple times, indicating persistent attempts to maintain access. Fraudulent tweets promoted crypto scams using deepfake images of Michael Saylor, redirecting to malicious domains linked to prior scams.
The fraudulent posts were strategically designed to look convincing:
The goal was simple: trick FalconFeeds' followers into clicking the link and stealing their cryptocurrency.
One of the biggest concerns surrounding this attack was how the attackers gained access despite MFA. After extensive forensic analysis, the most likely culprit was identified: session hijacking.
Session hijacking occurs when an attacker steals an active session token, allowing them to access an account without needing a password or MFA code.
This bypassed all traditional security measures, giving them full control over the account for over seven hours.
As the investigation unfolded, it became clear that this was not an isolated incident. Other verified X accounts had been compromised in the same way, all promoting similar cryptocurrency scams.
The scam website used in the attack, mstr-x2-giveaway.com, was linked to a broader network of fraudulent domains, including:
Some of these domains were previously used in YouTube crypto scams, confirming that the same group of cybercriminals had been running these attacks for months.
A closer look at the domain registrations uncovered an email address linked to 200+ scam domains:
These findings suggest a large-scale, organized cybercrime operation targeting high-profile accounts to amplify fraudulent schemes.
Once the attack was confirmed, immediate action was taken to regain control of the account.
While the account was successfully recovered, the incident had far-reaching consequences:
This attack is a wake-up call—not just for FalconFeeds, but for the entire cybersecurity community.
If you manage a high-profile account or deal with sensitive data, here’s how to protect yourself:
The compromise of the @FalconFeedsio X (formerly Twitter) account highlights the increasing sophistication of cyber threats targeting high-profile social media accounts. Despite the implementation of MultiFactor Authentication (MFA), the attackers successfully bypassed security measures through session hijacking, gaining unauthorized access to an employee's session.
This incident not only caused reputational damage but also exposed followers to financial scams, demonstrating the far-reaching impact of such attacks. The attackers' use of deepfake images, strategic keyword manipulation, and a network of fraudulent domains suggests a well-coordinated effort to exploit cryptocurrency enthusiasts.
Moving forward, we are ensuring a proactive approach to cybersecurity by implementing stronger session security measures, conducting regular security audits, enforcing stricter access controls, and continuously monitoring for suspicious activities. Additionally, we are committed to enhancing employee training on session security best practices to prevent similar incidents in the future. Strengthening authentication mechanisms and refining incident response protocols will also be crucial in mitigating session hijacking risks.
This incident serves as a critical reminder that security defenses must evolve alongside emerging attack techniques to effectively safeguard digital assets and online identities.
Stay vigilant. Stay informed. Stay secure.
FalconFeeds.io
