Who are the X-account hunters? How they steal digital identities and followers

But users are getting smarter every day, which is why criminals have developed more targeted attacks called spear phishing. In this case, journalists, influencers, politicians and managers become specific targets: messages are tailor-made to circumvent mistrust barriers. Often, there is a person behind the management of the breach who can modify the attack to make it more credible and effective.

Complementing these attacks comes an increasingly common stratagem: SIM swap. The hacker convinces the telephone operator to transfer the victim's phone number to a new card of his own, thus gaining access to the authentication codes sent by SMS. This does not seem to be the case, since the minister did not report any problems with his phone number.

If none of the above systems work, criminals may try to exploit a bad habit many people have, that of reusing the same password on multiple services. With credential stuffing, hackers use databases of stolen credentials from other breaches to try them out on X, trusting that the user has kept the same e-mail address/password combination. This approach is very common and often underestimated. It may be at the root of the compromise, but it is unlikely to be enough.

There is also the fact that the problem does not always come from outside: in attacks that steal usernames and passwords, in fact, everything stems from a device that is compromised. With malware and keyloggers, attackers record keystrokes or steal session cookies, gaining direct access to the account. In particular, the theft of session cookies gives criminals full operational powers, but they often cannot change passwords. Crosetto stated that the criminals changed the e-mail address associated with his X account, but also that he had retained access to it. This is a fairly typical case if compromise by stealing cookies is met with additional security measures that prevent password changes.

Then there is the chapter of OAuth hijacking, the abuse of authorisation systems for external services. With an unconscious click, a user can grant a malicious app permanent access to his profile X via session tokens. Very difficult not to fall for this if done right, this attack however assumes a type of access that is rarely seen on this platform for people of a certain importance.

Finally, the oldest and at the same time most modern of techniques: social engineering. Hackers pretend to be employees, business partners or even technical support staff of X, convincing the victim to share confidential data. In these cases, protection is not technical, but organisational: clear internal processes and the golden rule of always verifying identity before acting.

So which technique was used against Minister Crosetto? From a distance we cannot know, but almost certainly one of those listed. In some breaches, more complex vulnerabilities are used, but for serious things like stealing large amounts of money or secrets (whether state or industrial), not for trivial scams like the one reported. There is, however, one detail that should not be overlooked: Russia likes to ridicule (by their standards) their adversaries, and in their perspective they may have brought a sophisticated attack to our Defence Minister by disguising it as a 'stupid' attack to show his lack of 'defence' capability (if you pardon the pun). It could therefore be an attack

or sophisticated with an almost boorish purpose, if you like. It would be strange, but possible.