X users are being targeted with a wave of unsolicited password reset emails following the launch of X Money, the social media platform’s new payments service.
The company says it is investigating the activity but has so far found no evidence that attackers successfully breached accounts.
X product engineer Mridul Singhai said on Tuesday that the company was looking into reports from users who had received multiple password reset messages. He said attackers appear to believe that the wider availability of X Money could allow them to gain unauthorized access to accounts.
“We are actively investigating the issue and, so far, have found no evidence of any breaches,” Singhai said, while apologizing for the repeated emails and asking users for patience as the company works to resolve the issue.
X Money is the company’s newly launched payments service, offering features including a bank card and other financial services. The service is designed to make it easier for creators and other users to send and receive money through the platform, expanding X’s growing digital economy.
The timing of the password reset attempts has raised concerns because accounts connected to the payments service could potentially become more attractive targets for attackers. However, X has not said that any X Money accounts or user funds have been compromised.
X has not published detailed information about the incident through one of its official company accounts and had not responded to a press inquiry at the time of writing. X general counsel James Burnham, however, said the company’s legal and security teams would work to identify and hold accountable anyone attempting to target users on or off the platform.
Users have also been warning others about the ongoing password reset attempts and recommending that they enable two-factor authentication. X’s AI chatbot Grok has responded to some users, saying attackers are “mass-triggering” the password reset form using publicly available usernames.
According to Grok, there is currently no confirmed system breach or evidence of widespread account takeovers. The password reset emails therefore appear to be part of an attempt to trigger the recovery process rather than evidence that attackers have already gained access to users’ accounts.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
