Cyber agencies warn of more X account hacks in festive season

An assessment by Indian cyber agencies says India, along with the US, UK, Australia, Japan, South Korea and several European countries, faces a growing wave of hacks targeting X accounts. The activity is driven by hackers allegedly hired by cryptocurrency traders to promote crypto schemes, with high-follower handles singled out. Sources said the report warns of bigger waves during India's festive season, when online activity and company advertising surge. Two months ago, a fake-DM method compromised accounts within seconds.

Written by AI from News18 — India · not yet reviewed by an editor · Published 18 Sept 2026, 10:28 am IST

Source

News18 — India · read the original report ↗

#cybersecurity#x hacking#crypto scam#festive season#phishing

Desk check · some claims need care

What the desk checked (5)

Indian cyber agencies assess that hacks targeting X accounts are rising in India, the US, UK, Australia, Japan, South Korea and several European countries. — Attributed in source to an assessment by Indian cyber agencies; agency not named.
Hackers are allegedly hired by cryptocurrency traders to promote crypto schemes and manipulate audiences. — Source itself uses 'allegedly'; unverified allegation within the assessment.
The report warns of bigger waves of hacks during India's upcoming festive season. — Sourced to unnamed 'top-level sources'; no document cited.
About two months ago a fake-DM wave hit Indian users, changing linked emails and filling profiles with crypto posts. — Described in source without attribution to a named agency or victim.
On September 1, 2026, thousands of X users received unsolicited password-reset emails; X said it found no evidence of a system breach, noting the timing coincided with the X Money rollout. — Figure and dates appear in source; X response attributed to the company.

Written by AI from News18 — India · not yet reviewed by an editor · How we use AI · Report an error

Analysts’ view opinion

AI Technology Analyst

This is less a story about a broken platform than about a broken trust primitive: attackers are monetising the credibility of large accounts rather than the accounts themselves. The fake-DM technique described — a message that looks like it came from a mutual connection, asking for a small favour like a vote — works because it exploits social proof, not a software flaw, which is why account-level defences alone rarely stop it. With the assessment warning of bigger waves in the festive season, the risk concentrates exactly where brands are spending most on social advertising and where users are least likely to pause before clicking.

The targeting logic is reach, not wealth: high-follower handles are hijacked because their audience trust converts crypto promotions faster than anonymous spam.
The described attack chain — link click, instant takeover, linked email changed, then DMs to the victim's contacts — makes the hack self-propagating, which is why waves spread fast across countries.
For advertisers, festive-season ad blitzes create noise that makes fraudulent promotional posts harder for users to distinguish from legitimate campaigns.
The story says X has damage-control systems in place but that these will need tightening, so the practical question is response speed and account-recovery friction rather than whether defences exist at all.
The September 1 password-reset email wave, which X attributed to no system breach, is a reminder that visible alarm signals and actual compromise are not the same thing — though it does show how jittery the crypto-adjacent user base has become.

What to watch — Watch whether X strengthens link handling, DM warnings and email-change verification ahead of the festive peak, and whether brands running large social campaigns add visible verification cues for their own promotions.

The story rests on an official assessment and unnamed top-level sources; it does not establish who the alleged crypto traders or hired hackers are, the scale of losses, or any confirmed platform-side vulnerability.

Deep dive

Research brief · 8 facts · 3 dates · exam-ready

The brief

Context

An assessment by Indian cyber agencies flags a growing, cross-border wave of hacks targeting accounts on X (formerly Twitter), affecting India as well as the US, UK, Australia, Japan, South Korea and several European countries. The activity is attributed to hackers allegedly hired by cryptocurrency traders to push crypto schemes and manipulate online audiences, with high-follower handles targeted for their reach and credibility. Almost two months before the report, a "fake-DM" wave swept Indian users, hijacking accounts within seconds. Sources say the assessment warns of bigger waves during India's festive season, when online activity and corporate advertising spike.

Key facts

An assessment by Indian cyber agencies says India, along with the US, UK, Australia, Japan, South Korea and several European countries, faces a growing wave of hacks targeting X accounts.
The hacking is driven by hackers allegedly hired by cryptocurrency traders to promote crypto schemes and manipulate online audiences.
Well-known X handles with large followings are being singled out for their reach and credibility.
Top-level sources say the report warns of bigger waves during India's upcoming festive season, when online activity surges.
Almost two months before the report, a wave of X account takeovers using a fake-DM method hit Indian users.
In the fake-DM attacks, victims who clicked a link sent by an apparent mutual connection had accounts hacked within seconds, linked emails changed and profiles filled with crypto posts.
On September 1, 2026, thousands of X users, including prominent crypto figures, received unsolicited password-reset emails, some up to ten within hours.
X said it found no evidence of an actual system breach, but noted the timing coincided with the wider rollout of its new payment feature, X Money.

Timeline

Almost two months before September 18, 2026A wave of X account takeovers using the fake-DM method sweeps through Indian users; accounts hijacked within seconds and filled with crypto posts.
September 1, 2026Thousands of X users worldwide, including prominent crypto figures, receive unsolicited password-reset emails; X reports no evidence of a system breach, notes timing coincided with wider X Money rollout.
September 18, 2026Report published on the Indian cyber agencies' assessment warning of more X account hacks during the festive season.

Who has a stake

Indian cyber agencies — Prepared the assessment; responsible for warning users and coordinating response ahead of the festive season surge.
X (the platform) — Has placed damage-control systems in place; the assessment says these need further tightening before the festive season.
High-follower X handles and influencers — Singled out as targets because their reach and credibility make crypto promotion more effective.
Ordinary Indian X users — Risk of account takeover within seconds via fake DMs, loss of linked email control and spread of scam DMs to their own contacts.
Companies advertising on social media — Festive-season ad campaigns could be targeted and exploited by hackers, amplifying the impact of attacks.
Cryptocurrency traders allegedly hiring hackers — Named in the assessment as drivers of the activity to promote crypto schemes.

Why it matters

Social media takeovers of trusted, high-follower handles convert credibility into a tool for financial fraud, and the festive season multiplies both the number of active targets and the volume of commercial messaging that scams can hide behind. With India named alongside major economies in a coordinated cross-border pattern, the episode shows how platform-level account security has become a consumer-protection and financial-integrity issue, not just a technology problem.

UPSC angle

Prelims pointers

Indian cyber agencies' assessment names India, US, UK, Australia, Japan, South Korea and several European countries as facing the X hacking wave.
Attack vector: fake direct messages appearing to come from a mutual connection, often seeking a vote for an influencer contest.
September 1, 2026: thousands of X users got unsolicited password-reset emails, some up to ten within hours.
X Money is X's new payment feature; its wider rollout coincided with the password-reset email wave.
Motive cited: hackers allegedly hired by cryptocurrency traders to promote crypto schemes.
Compromise signs: linked email changed, profile filled with crypto posts, similar DMs sent to the victim's contacts.

Mains framing

The assessment by Indian cyber agencies points to a maturing crime model in which social engineering, not system breaches, is the primary attack surface: fake DMs from apparently trusted mutual connections harvest credentials in seconds, and hijacked high-follower handles are then monetised by pushing cryptocurrency schemes on behalf of traders who allegedly hire the hackers. Three features make this significant. First, the activity is transnational, spanning India, the US, UK, Australia, Japan, South Korea and parts of Europe, so attribution and takedown depend on cross-border cooperation. Second, the festive season creates a demand-side vulnerability: heavy user activity plus a flood of company advertising gives attackers both more targets and better camouflage. Third, platform trust is at stake, as seen in the September 1, 2026 password-reset email wave, where X denied any system breach but acknowledged it coincided with the wider rollout of X Money. The way forward suggested in the source is narrow but concrete: X's existing damage-control systems require further tightening ahead of the season, alongside user vigilance about links in DMs and monitoring of linked email changes. A fuller regulatory or enforcement response is not stated in the source.

Key terms

Fake-DM method: Attack where a direct message appearing to come from a mutual connection asks for support, such as a vote, and the link steals account access within seconds.
Account takeover: Hacker gains control of a user's account, changes the linked email and posts content, here crypto-related, in the victim's name.
X Money: X's new payment feature; its wider rollout coincided with the September 1, 2026 wave of unsolicited password-reset emails.
Password-reset email flood: Mass unsolicited reset messages to users, sometimes ten within hours, without evidence of an actual platform breach according to X.
Crypto promotion scheme: Use of hijacked, high-credibility handles to push cryptocurrency offerings and manipulate online audiences.

Practice questions

Examine how social engineering techniques such as fake direct messages exploit trust networks on social media platforms, and what this implies for cyber security policy in India.
Festive-season surges in online activity and advertising create predictable windows of cyber vulnerability. Discuss with reference to the recent assessment on X account hacks.
Platform-level account security is now a matter of financial integrity, not merely user convenience. Critically evaluate in light of crypto-driven account takeovers across multiple countries.

Grounded only in the source report — figures and dates are the source's, not inferred.

Next storyGambhir says dropping Samson was his toughest coaching decision →

← All stories