Arrests made in Twitter hacking case, 17-year-old Florida native alleged ringleader

US authorities have arrested a 17-year-old from Florida for being the alleged mastermind of the Twitter hack that targeted the accounts of several high-profile individuals on 15 July 2020.

Graham Clark of Tampa Florida in the United States, along with two others, were charged for hacking into the accounts of Barrack Obama, Kanye West and Joe Biden, among others, and using their stolen social media credentials in an audacious bitcoin scam.

The hacked accounts solicited their followers to send bitcoin to a certain crypto wallet, promising to return double the amount as a charitable gesture. More than US$110,000 in bitcoin had been deposited in one account belonging to the alleged perpetrators before the scam messages were removed by Twitter.

Twitter said the hackers got access to its internal systems through a spear-phishing attack on several employees. Spear phishing is a technique used by hackers to dupe users into clicking on malicious links or giving away sensitive data by crafting fake emails or other messages. The hackers then gained access to a Twitter “admin” tool on the company’s network that allowed them to hijack the accounts.

The social media giant said the attackers managed to gain access to 130 accounts and tweeted from 45 of them.

Twitter sent a message expressing gratitude to law enforcement: “We appreciate the swift actions of law enforcement in this investigation and will continue to cooperate as the case progresses. For our part, we are focused on being transparent and providing updates regularly.”

Read: Twitter says direct messages of 36 people were accessed in last week’s hack

Social engineering attacks such as spear phishing only succeed if people fall for their unlikely messages – which rely on people suspending their disbelief simply because the tweet comes from a source they are inclined to trust, noted Paul Ducklin, principal research scientist, Sophos.

“If a message sounds too good to be true, it is too good to be true,” said Ducklin. “If Musk, Gates, Apple, Biden, or any well-known person or company wanted to hand out huge amounts of money on a whim, they wouldn’t demand that you hand them money first. That’s not a gift, it’s a trick, and it’s an obvious sign that the person’s account has been hacked. If in doubt, leave it out,” he added.