Twitter's 2020 hack: fake IT calls and 130 targeted accounts

employee-facing OSINT exposure (LinkedIn roles, recruiter-visible contact details) is very hard to eliminate at enterprise scale; the realistic control assumes attackers already have this information and instead hardens the process it later gets used against, at Stages 2 and 3.

mandatory out-of-band verification of any inbound "IT help desk" call through a known internal number or channel before taking any credential-related action, plus training that frames unsolicited support calls citing urgent VPN or account problems as inherently suspect; a normalized, low-friction reporting path matters here, since some Twitter employees did report the calls to Twitter's internal fraud monitoring team even as four were duped into surrendering credentials.

a strict employee habit and policy of only authenticating through a bookmarked or pre-saved internal portal URL, never a link supplied by an inbound caller, combined with monitoring for look-alike domains mimicking internal login pages.

phishing-resistant MFA such as FIDO2 or hardware security keys (or platform passkeys), which cryptographically bind the authentication to the legitimate origin and cannot be captured and relayed by a real-time adversary-in-the-middle the way an OTP code or push approval can.

strict least-privilege and just-in-time access to sensitive account-management tools, so that compromising a lower-privilege employee's credentials does not by itself give attackers the internal process knowledge needed to identify and target higher-privilege staff.

step-up authentication and anomaly monitoring on privileged account-management actions (mass password resets, MFA disables, email changes across many accounts in a short window), paired with a staffed, empowered security leadership function; Twitter had gone without a CISO for the seven months before the hack, which the DFS report identified as a root-cause leadership gap.

cryptocurrency-exchange transaction monitoring and rapid wallet-address blocklisting, which is what actually limited the damage here. Four DFS-regulated firms blocked 6,031 attempted transfers worth about $1,347,050; separately, the three firms whose own Twitter accounts were hijacked (Coinbase, Gemini and Square) blocklisted the scam addresses within 40 minutes of their accounts being hacked, and DFS instructed all its cryptocurrency licensees to block the addresses at 6:59 p.m. on July 15. Pair that with the platform's own rapid account lockdown and tweet-blocking response.