X Investigates Surge in Unsolicited Password Reset Requests

Mridul Singhai, a member of the X Product Engineering team, confirmed on Tuesday that the company is actively reviewing reports from users who received unexpected login recovery messages. While account holders expressed concern over potential unauthorized access, Singhai emphasized that X’s internal systems remain secure. The company has not disclosed the scale of the campaign or the specific methods used to trigger these automated requests.

Attackers appear to be betting that the integration of X Money—which allows U.S. subscribers to transfer funds and use a Visa debit card—makes compromised accounts more lucrative. To mitigate risk, X recommends that users enable two-factor authentication and activate "Password reset protection" within their security settings. This feature requires additional verification, such as a phone number or email confirmation, before the platform will issue a reset link. Users are also advised to avoid clicking links in suspicious emails and to verify that they are interacting with the official x.com domain before entering any credentials.