X Money rollout linked to password-reset attacks
X is investigating bulk unsolicited password-reset emails as its X Money payments service expands, with no confirmed breaches or account takeovers yet.
X users began reporting unexpected password-reset emails and codes on September 1, and product engineer Mridul Singhai said attackers appear to believe newly widespread X Money access makes accounts worth targeting. X says it has found no evidence of any breach or successful account takeover, and completing a reset still requires access to the account's email or phone number. X Money offers eligible US users interest-bearing accounts, a Visa debit card, and P2P payments, with Cross River Bank providing banking infrastructure. Malwarebytes warns the reset flood can serve as cover for phishing and urges reset protection, 2FA, and unique passwords.
- Unsolicited reset emails reported since September 1
- No confirmed breach, fund access, or account takeover so far
- X Money adds financial services via Cross River Bank
- Reset flooding can enable phishing or obscure real alerts
- Guidance: reset protection, authenticator-based 2FA, unique passwords
- Vendors
- XMalwarebytes
- Products
- X Money
- Victims
- X users
- Organizations
- Cross River Bank
- Countries
- US
From the original article
3 min read at malwarebytes.com
As X expands into payments, users are receiving password-reset emails they didn’t request. Here’s what may be happening and how to stay safe.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.