🚨 Getting Unexpected X Password-Reset Emails? Don't Panic — But Don't Ignore Them

The attacker doesn't necessarily need to compromise X.

They can attempt to make you voluntarily provide the credentials.

This is classic social engineering:

Trigger → Panic → Urgency → Fake Recovery → Credential Theft

X has recently expanded the availability of X Money, which introduces payment-related functionality to the platform.

That potentially increases the value of certain accounts.

Attackers may be particularly interested in accounts belonging to:

Cryptocurrency users

Traders

Influencers

Businesses

Creators

Public figures

Accounts connected to financial activity

X itself said attackers appear to believe that the wider availability of X Money creates an opportunity to gain unauthorised access to accounts.

Important:

That is X's current assessment of the attackers' apparent motivation—not proof that X Money itself was compromised.

A compromised X account can be more valuable than just its follower count.

An attacker may use a compromised account to:

🎣 Spread phishing

Send malicious links to followers.

This is an interesting security distinction.

A victim may receive a genuine X-generated email, but the event can still be part of a malicious campaign.

Why?

Because the attacker may have triggered the legitimate recovery mechanism.

So the email may genuinely originate from X.

That doesn't mean:

The person requesting the reset is legitimate.

This is why blindly trusting an email because it appears to come from a legitimate service is dangerous.

X's official guidance says X emails come from:

@X.com

or

@e.X.com

X also states that it will never ask for your X password by email and warns users about suspicious emails and links.

But don't rely only on the sender address.

Attackers can create convincing phishing messages.

Better approach:

Don't use the email to investigate the account.

Instead:

Open the X application directly

or

Type X.com into your browser yourself.

Then check:

Account security

Login activity

Connected applications

Two-factor authentication

Password settings

If you did not request a password reset:

Don't interact with the email.

Don't:

❌ Click the link

❌ Reply

❌ Enter your password

❌ Enter an OTP

❌ Download attachments

❌ Call a phone number included in the message

Instead, open X independently.

X itself advises users to be cautious about unexpected emails and says it will not ask users to download software or sign in to a non-X website.

One of the most useful protections to enable is:

Password Reset Protect

This adds an additional requirement before a password reset can be initiated.

According to current reporting and X's support guidance, this can require confirmation of the account's email address or phone number before initiating the reset process.

This can reduce the effectiveness of automated reset attempts based only on publicly known usernames.

or

🔑 Security key/passkey where supported

as an additional authentication factor.

X itself recommends two-factor authentication as an additional protection layer for account security.

A compromised account doesn't always involve password theft.

Third-party applications may have account access.

Go to your X security settings and review connected applications.

Remove anything you:

Don't recognise

No longer use

Don't trust

X specifically recommends revoking access to unfamiliar third-party applications when an account may have been compromised.

Your X account is only as secure as the email account associated with it.

If someone controls your email account, they may potentially control password-reset workflows for other services as well.

Therefore:

Secure both:

X account

Recovery email account

Use:

The response depends on what happened.

If you only opened the page:

Close it.

Don't enter anything.

Update your browser if necessary.

If you entered your X password:

Do it directly through X—not through the email.

If you entered an OTP:

Treat the account as potentially compromised.

If you approved a third-party application:

Immediately revoke that application's access.

If suspicious posts or DMs appear:

Follow X's compromised-account recovery procedure.

CURRENTLY REPORTED/LIKELY MODEL

Public X Username

↓

Automated Reset Request

↓

Legitimate X Reset Email

↓

Victim Confusion

↓

Potential Follow-up Phishing

↓

Credential / OTP Theft

↓

Account Takeover

↓

Crypto / Financial / Phishing Abuse

⚠️ The final stages represent a potential attack scenario, not confirmation that this exact chain has occurred for every recipient.

Stage Technique / Risk

Target Discovery Public X usernames

Initial Activity Automated password-reset requests

Delivery Legitimate X reset email

Social Engineering Fear / urgency

Potential Second Stage Phishing

Credential Theft Fake login page

MFA Theft OTP/social engineering

Persistence Third-party application access

Impact Account takeover

Secondary Impact Fraud / phishing / financial scams

✔ Confirmed

X users are reporting unsolicited password-reset emails.

X says it is investigating the activity.

X has stated that it has not found evidence of a breach so far.

Attackers appear to be targeting accounts using the password-reset mechanism.

⚠️ NOT CONFIRMED

❌ X database breach

❌ Mass account takeover

❌ User password database leak

❌ X Money infrastructure compromise

❌ Confirmed theft of user credentials

There is currently no evidence establishing these claims.

If you receive an unexpected X password-reset email:

1️⃣ DON'T PANIC

Receiving the email doesn't prove you're hacked.

2️⃣ DON'T CLICK

Don't use the email's link.

3️⃣ OPEN X DIRECTLY

Use the official app or manually enter X.com.

4️⃣ ENABLE PASSWORD RESET PROTECT

Add an additional barrier to reset requests.

5️⃣ ENABLE 2FA

Prefer stronger authentication options where available.

6️⃣ REVIEW CONNECTED APPS

Remove anything suspicious.

7️⃣ CHECK LOGIN ACTIVITY

Look for unfamiliar sessions/devices.

8️⃣ SECURE YOUR EMAIL

Your recovery email is part of your security perimeter.

9️⃣ CHANGE PASSWORD IF NECESSARY

Especially if you entered credentials into a suspicious website.

🔟 MONITOR

Watch for unexpected:

Posts

DMs

Follows

Account changes

Password changes

This incident demonstrates a powerful concept:

A security notification can itself become part of an attack.

Users are trained to react immediately when they see:

Your account is under attack!

Attackers understand this psychology.

They can use a real security event—or manufacture one—to create panic.

The victim then becomes easier to manipulate.

Think Before You Click. Stay Aware. Stay Secure.