Listen to the episode
TLDR
Attackers are sending bulk unsolicited password reset emails to X users, timing the wave to coincide with the wider rollout of X Money payments. Even though X says no accounts have been compromised, the noise can hide phishing attempts,...
How it works
Attackers are sending bulk unsolicited password reset emails to X users, timing the wave to coincide with the wider rollout of X Money payments. Even though X says no accounts have been compromised, the noise can hide phishing attempts,...
Red flags
- You receive an X password reset email or code you never requested. A message pressures you to act fast or asks for a reset/2FA code. Links in the email point to look alike login pages rather than x.com. What to do Ignore unexpected reset emails
- open the X app or type x.com manually. Enable Password reset protection and two factor authentication with an authenticator app. Verify any suspicious message with Malwarebytes Scam Guard before clicking anything
What to do
- 1Red flags You receive an X password reset email or code you never requested.
- 2Verify any suspicious message with Malwarebytes Scam Guard before clicking anything.
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/scams/2026/09/x-money-rollout-linked-to-password-reset-attacksFAQ
Is X password reset spam tied to X Money rollout: how to stay safe a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
You receive an X password reset email or code you never requested. A message pressures you to act fast or asks for a reset/2FA code. Links in the email point to look alike login pages rather than x.com. What to do Ignore unexpected reset emails; open the X app or type x.com manually. Enable Password reset protection and two factor authentication with an authenticator app. Verify any suspicious message with Malwarebytes Scam Guard before clicking anything
What should I do first?
Red flags You receive an X password reset email or code you never requested.; Verify any suspicious message with Malwarebytes Scam Guard before clicking anything.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.