1-Click Phishing Campaign Targets High-Profile X Accounts

SentinelLabs observed an active phishing campaign targeting high-profile X accounts (journalists, political figures, organizations, and valuable short usernames) to perform account takeovers and post cryptocurrency scams; attackers use email lures (login alerts, copyright notices), phishing pages (including abuse of Google's AMP cache), and flexible infrastructure (domains such as securelogins-x.com and x-recoverysupport.com, a Belize-based VPS IP, Turkish-registered domains) to maximize reach and financial gain, and researchers recommend strong password hygiene, 2FA, and verifying URLs before clicking.