Urgent Warning: Crypto Users Targeted in New York Post X Account Scam

Are you active in the crypto community on X (formerly Twitter)? You need to be aware of a recent security incident. Reports indicate that malicious actors have gained unauthorized access to the official New York Post X account, using it to target crypto users with deceptive direct messages. This incident highlights the ongoing threat of social media hack campaigns aimed at the digital asset space.

Understanding the New York Post X Account Compromise

The New York Post’s verified X account appears to have been compromised, allowing hackers to send unsolicited direct messages to various users, particularly those within the crypto community. These messages reportedly offered opportunities like interviews for podcasts, attempting to lure users into further communication on platforms like Telegram or Zoom.

Key observations about this social media hack:

• Messages originated from the legitimate @nypost account, lending false credibility.
• The initial contact typically offered an interview or similar collaboration.
• Users were directed away from X to other platforms (Telegram, Zoom) for follow-up.
• After sending the message, the scammer reportedly blocked the recipient on X, potentially to prevent them from replying or alerting the New York Post directly via the platform.

Cybersecurity experts noted this approach differs slightly from typical crypto scams, which often involve direct wallet drainers or links to phishing sites. Instead, this method focuses on social engineering, building trust through a seemingly legitimate source before attempting the actual exploit.

How the Crypto Scams Unfolded

Reports from users like Kerberus founder Alex Katz and Fomojis’ Donny Clutterbuck brought this issue to light. Screenshots shared showed messages appearing to come from the New York Post account, sometimes even mentioning specific journalists like Paul Sperry. The goal was seemingly to initiate contact and move the conversation to less secure or private platforms where the actual scam could be executed.

One theory regarding potential entry points involved video conferencing platforms like Zoom. One user speculated that enabling audio in certain contexts might inadvertently grant network access to malicious actors, though this remains unconfirmed as the specific vector for the NY Post compromise. However, the pattern of directing users to Zoom aligns with other recent crypto scams.

Blockchain investigator ZachXBT pointed out the similarity of this incident to a recent X account compromise affecting The Defiant, where direct messages were also used to target users.

The Rising Threat of Zoom Scams

Beyond the New York Post X account issue, Zoom has become a significant platform for crypto scams. Scammers leverage the perceived professionalism of a video call to conduct social engineering attacks or deliver malware.

A notable example is the case of Emblem Vault CEO Jake Gallen, who lost $100,000 in crypto after being contacted via X for a supposed Zoom interview. During the call, malware was installed on his system, leading to his wallets being drained. This illustrates the danger once scammers successfully move the interaction off the initial social media platform.

This isn’t the first time the New York Post’s social media presence has faced issues. In 2022, an internal incident led to the verified Twitter account posting inappropriate messages, though that was attributed to an employee rather than external hackers.

Protecting Yourself from Social Media Hacks and Crypto Scams

Given the frequency of these incidents, especially involving verified accounts, staying safe requires vigilance. Here are some actionable steps:

• Verify Independently: If you receive a suspicious message from a major news outlet or company account, do not reply or click links within the message. Navigate directly to their official website or X profile to look for public announcements or alternative contact methods.
• Be Skeptical of DMs: Be extremely cautious of unsolicited direct messages, especially those offering lucrative opportunities, interviews, or asking you to move to another platform like Telegram or Zoom.
• Enable Two-Factor Authentication (2FA): Secure your social media accounts with strong 2FA methods (preferably not SMS-based).
• Review App Permissions: Regularly check and revoke permissions granted to third-party apps connected to your social media and other online accounts.
• Educate Yourself: Stay informed about common scam tactics, including phishing, malware distribution, and social engineering.
• Isolate Sensitive Activities: Avoid conducting sensitive crypto activities or accessing wallets on devices used for general browsing, social media, or video calls, especially if you’re interacting with new or unverified contacts.

While the New York Post has not yet publicly commented on the X account compromise, users should assume the account may have been compromised and exercise extreme caution regarding any direct messages received from it.

Summary

The incident involving the New York Post’s X account sending scam DMs to crypto users is a stark reminder that even verified, high-profile accounts can be compromised and used for malicious purposes. These social media hacks are evolving, with scammers increasingly using sophisticated social engineering techniques to move victims to platforms like Telegram and Zoom where the final exploit occurs. Protecting yourself requires skepticism towards unsolicited messages, independent verification, and robust security practices for all your online accounts and devices. Stay alert and stay safe in the digital landscape.