Unexpected X password-reset emails may provide cover for phishing

Malwarebytes reports a wave of unsolicited X password-reset emails and codes. X says it has found no evidence of a breach or successful account takeovers, but fake messages could still trick users.

Who should care and what to do today

This matters to anyone with an X account who receives a password-reset email or code they did not request. It may matter more to eligible United States users with X Money, people who use X for business, and accounts with many followers. Malwarebytes says accounts with payment access, business use, high follower counts, or information useful for impersonation may be more attractive targets.

Do not use the message to check your account. Open the X app or type x.com into your browser yourself. Then review the account and turn on password-reset protection under Settings and privacy > Account > Security > Password reset protection.

Do not click an unexpected reset link, enter a code from the message, or share a reset code with anyone who contacts you. Do not disable security controls just to stop the alerts.

What Malwarebytes reports

Malwarebytes says X users began reporting unexpected password-reset emails and codes on September 1, as X Money became more widely available. X product engineer Mridul Singhai said the company was investigating and had found no evidence of a breach.

X Money gives eligible United States users access to financial services within X, including interest-bearing accounts, a Visa debit card, and person-to-person payments. Cross River Bank provides the banking infrastructure behind the service. Malwarebytes says X has not confirmed that X Money caused the reset activity, so the timing does not prove a connection.

The reported activity appears consistent with attackers sending large numbers of password-reset requests. A reset request is not the same as a completed password change, and it does not by itself show that someone took over an account. Malwarebytes also reports no evidence that anyone accessed X Money accounts or funds.

Why real reset emails can make scams harder to spot

A real reset message arriving at the same time as a fake one can make a scam look convincing. Malwarebytes says large volumes of legitimate-looking messages may provide cover for phishing, a scam that tries to make you reveal information or visit a harmful website.

Someone may feel pressured to change a password unnecessarily, miss a more important security notice, or turn off account protections. The safer way to inspect the account is to use the app or type the website address yourself, rather than following an email link.

X’s recovery process requires access to the email address or phone number connected to the account before a reset can be completed, according to the report. That means an unwanted request alone does not complete the reset, but it does not make an emailed link safe to use.

Account checks worth making

After opening X directly, look for unfamiliar posts, direct messages, profile changes, login alerts, or apps connected to the account. These can be signs of an account takeover, although the report does not say that such takeovers have been confirmed in this activity.

Use a unique, strong password for X. If the same password is used elsewhere, change it through X’s settings rather than through an email link. Add two-factor authentication, which requires another verification step after a password. Malwarebytes recommends an authenticator app or security key where available.

Do not reply to a suspicious message or give information to someone claiming to be support, an advertiser, or a security worker. Malwarebytes says its Scam Guard service can help people check a suspicious message.

Primary source

This article is based on Malwarebytes’ report, “X Money rollout linked to password-reset attacks,” published September 4, 2026: https://www.malwarebytes.com/blog/scams/2026/09/x-money-rollout-linked-to-password-reset-attacks Read the complete original source.

Article history: Published Sep 4, 2026 at 8:49 am EDT. Updates and corrections are noted here when material facts change.