Fake X login alerts steal accounts via phishing
X phishing scam
A new X phishing scam is circulating that begins with a convincing fake login alert sent to your inbox. The message claims someone logged into your account from an unfamiliar device and urges you to click a link to reset your password or review app access.
At a glance the email looks legitimate: it mirrors X’s branding, colors and tone, and even uses clean grammar and spelling. That’s deliberate—scammers rely on that realism to trick you into following scam links or approving a malicious app that can lead to account takeover.
Why the phishing email is convincing
The emails often mimic X’s security notices closely, but the critical giveaways are subtle. Jake Moore, global cybersecurity adviser at ESET, notes the main tells are the sender address and the actual destination of links. In many cases the links don’t go to X at all but to pages designed to steal credentials or prompt you to grant full access to a scammer’s app.
How to check and respond
- Do not click links in the email. If you see a fake login alert, open the X app or website directly to check for notifications there.
- Verify sender address. X’s help pages state official emails come from @X.com or @e.X.com and will never ask for your password by email, DM, or reply.
- Ignore requests to enter one-time codes or passwords on sites you didn’t verify—these are often part of a reset password scam.
If you already entered your password or a one-time code on a page you suspect is fraudulent, change your password immediately and enable two-factor authentication. Turning on two-factor authentication helps protect your X account by making it much harder for scammers to complete an account takeover even if they have your password.
These security email spoofing attempts highlight the importance of pausing before you click. Verify the sender, avoid scam links, and check security alerts from within the official app to stay safe.
