Three men charged for their role in the recent hack of celebrity Twitter accounts, used phone spear-phishing trick

With files from Pragya Sehgal

The U.S. Department of Justice has charged three men in the Twitter hack and bitcoin scam of two weeks ago, with officials in Florida declaring 17-year-old Florida juvenile, Graham Ivan Clark, as the “mastermind” of the hack.

With exceptions that do not apply to this case, juvenile proceedings in federal court are sealed to protect the identity of the juvenile. Under the Federal Juvenile Delinquency Act, the Justice Department has referred Clark to the State Attorney for the 13th Judicial District in Tampa, Florida.

The other two suspects include a 22-year-old Florida man Nima Fazeli, and a 19-year-old British man Mason Sheppard.

According to court documents seen by ZDNet, the FBI was able to track the identities of the accused through posts made on the Discord instant messaging service and a hackers forum called OGUsers before the hack. The trail led to email accounts, IP addresses, and even private messages.

“There is a false belief within the criminal hacker community that attacks like the Twitter hack can be perpetrated anonymously and without consequence,” U.S. Attorney David Anderson for the Northern District of California said in a statement.  “Today’s charging announcement demonstrates that the elation of nefarious hacking into a secure environment for fun or profit will be short-lived.  Criminal conduct over the Internet may feel stealthy to the people who perpetrate it, but there is nothing stealthy about it.  In particular, I want to say to would-be offenders, break the law, and we will find you.”

The scam saw hacked accounts of former president Brack Obama, current Democratic leadership candidate Joe Biden and a raft of celebrities sending out tweets promising to double the money people send to a bitcoin wallet.

It still isn’t clear exactly how the accounts were hacked. Twitter offered more detail on Thursday, stating that it was a phone spear-phishing attack. A “small number of employees” fell for a phone spear-phishing attack. “A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools. Not all of the employees that were initially targeted had permissions to use account management tools, but the attackers used their credentials to access our internal systems and gain information about our processes.

“This knowledge then enabled them to target additional employees who did have access to our account support tools. Using the credentials of employees with access to these tools, the attackers targeted 130 Twitter accounts, ultimately Tweeting from 45, accessing the DM (direct messages) in the inbox of 36, and downloading the Twitter Data of seven.

“This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems.”

The brief description led U.K.-based cybersecurity reporter Graham Cluley to suspect that the call or calls to Twitter staff were made to appear to come from Twitter’s support team, perhaps leaving a voicemail and asking them to call a number. If they did so a phoney support team person might have convinced the staffer to divulge their username and password.

“Since the attack, we’ve significantly limited access to our internal tools and systems to ensure ongoing account security while we complete our investigation,” the Twitter statement added. “As a result, some features (namely, accessing the Your Twitter Data download feature) and processes have been impacted. We will be slower to respond to account support needs, reported Tweets, and applications to our developer platform. We’re sorry for any delays this causes, but we believe it’s a necessary precaution as we make durable changes to our processes and tooling as a result of this incident. We will gradually resume our normal response times when we’re confident it’s safe to do so.”

The fact that a third-party was able to access Twitter’s internal tools after duping one or more employees into providing them access is deeply concerning and the company obviously needs to find ways to prevent future misuses both by employees and external actors, said Brett Callow, a British Columbia-based threat analyst for Emsisoft.
“Twitter was extremely lucky that this attack was carried out by a group of young people who appear to have simply committed a banal scam. Had it been the work of a sophisticated actor whose aim was to manipulate the markets, cause political mayhem or stir up international tensions, the outcome could have been far, far worse.”

Phone scams attempting to trick consumers into handing over their credentials are common. Automated voice mail scams pretending to be from the Canadian or U.S. tax departments, credit card companies and Windows support are just a few of them. ITWC contributing reporter Howard Solomon got one from someone claiming to be from the non-existent “Cybercrime Control Board of Canada”.

Some voicemail scams count on call displays showing spoofed numbers of real officials or companies.

The Twitter phone scam sounds like many SIM card swap cons sprung on support staff cellphone companies in attempts to get control of smartphones of business executives. The attacker either phones, or appears in person with a fake ID, claiming to be the owner of a lost cellphone and wanting to transfer the SIM card to a new phone. The criminal may know enough personal information of the target (birth date, social insurance number, mother’s maiden name) to convince that the staffer the request is legit. If successful, the crook may be able to access the victim’s email from the new phone, and, using that, perhaps access to the enterprise network.

The Canadian Anti-Fraud Centre details a number of phone scams. Among them, a scammer calls a franchise business and claims to be from the head office. The employee who answers the phone is told there are problems with one of the financial products offered, such as gift cards or money transfer services. The employee then selects some prepaid cards, activate them, and provide them to the scammer. The scammer may also ask them to conduct a series of money transfers. Thorough awareness training and detailed policy procedures are needed to avoid staff being victimized by phone scams.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@]

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now