The 2020 Twitter Hack: When Phone Calls Opened the Admin Tools
In July 2020 attackers hijacked famous Twitter accounts by tricking staff by phone. See how social engineering reached internal tools and what to learn.
On 15 July 2020, the Twitter accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Apple and others posted the same message: send bitcoin to an address, and double your money. The tweets were a scam, and the accounts had been taken over by attackers. The story is less about clever code than about people, and about how much power a company's internal tools can hold.
What happened
The attackers took over a number of high-profile accounts, and the fraudulent posts promised that anything sent to a bitcoin address would be returned doubled. Twitter's engineers responded within hours, and as a precaution the company temporarily stopped many verified accounts from tweeting at all. Analysis of the bitcoin address showed that more than a hundred thousand US dollars, roughly 120,000, was sent to the scammers.
Twitter later reported that the attackers targeted 130 accounts. They managed to tweet from 45 of them, accessed the direct message inboxes of 36 and downloaded the account data of seven. Several of the accounts belonged to well-known people, and the company said that it had no evidence that the attackers had accessed users' passwords.
How they got in
The method was social engineering. Twitter said that the attackers carried out what it called a phone spear phishing attack on a small number of employees. By pretending to be colleagues from the company's IT department, they persuaded staff to give up credentials for the company's internal systems. The attackers then used these to access the admin tools that Twitter's support teams used to manage accounts.
Once inside those tools, they were able to change the email address linked to targeted accounts and to reset passwords. This let them log in as the account owner and post the scam messages. Accounts protected with two-factor authentication were still vulnerable, because the internal tools allowed the support function to bypass such protections.
Who was responsible
Within weeks, US authorities arrested a 17-year-old from Tampa, Florida, Graham Ivan Clark, who was identified as the alleged organiser. Two other men, Mason Sheppard from the UK and Nima Fazeli from Florida, were charged in connection with the case. Clark pleaded guilty in March 2021 and was sentenced to three years in prison under a youthful offender arrangement. The investigation suggested that the group initially went after short, valuable usernames before turning to the high-profile takeover.
Regulatory findings
The New York Department of Financial Services published a report in 2020 that criticised Twitter's security practices. It said that the company had weaknesses in the way employees were trained to spot phone phishing and noted that many employees had broad access to the admin tools. Twitter said it had taken steps to limit access and improve detection.
Key points
| Weakness | Response |
|---|---|
| Employees tricked by phone | Training and a verification step for any request involving credentials |
| Wide access to powerful tools | Limit who can use them, require approval for sensitive actions |
| Support tools could bypass 2FA | Log, monitor and restrict account recovery functions |
| Rapid reaction | Containment plan, including the ability to freeze actions |
Why verification beats trust
A phone call can be convincing. The caller can sound confident, use the right internal vocabulary and create urgency, perhaps by saying that a system is down and needs a quick fix. Many people feel it is rude to question a colleague, which is exactly what the attacker relies on. A simple rule works better than good intentions: if someone asks for a credential, a code or access, hang up and call back on a number you already know, or confirm in a separate channel.
Technology can help as well. Hardware security keys resist phishing because they check the website they are talking to, so a fake login page cannot capture a usable response. They are not a defence against an attacker who persuades an employee to change settings through an admin tool, which is why the combination of training, limits on privileged tools and logging matters.
There is a lesson in the way the scam was designed too. The message was short, urgent and attached to a trusted name. Your customers see the same pattern in fake invoices and fake delivery notices, so it is worth telling them how you will and will not contact them.
The practical lesson for site owners
Attackers go after people because people can be talked into things. Agree with your team that nobody gives out passwords or codes on a phone call, a message or an email, whoever claims to be asking, and that anything urgent is checked through a second route. Give each person the minimum access they need and keep a record of who can do what on your website, hosting, domain and social accounts.
Be careful with account recovery too: the email address attached to your domain registrar and hosting account is the key to all of them, so protect it with two-factor authentication. See our security page for further advice, and our knowledge base for setting up two-factor authentication.
