Bloomberg Impersonator Scam Hijacks Accounts via Malicious Calendly OAuth
yuntiandeng · x · 2026-08-24
A user reported a sophisticated phishing attack where an attacker impersonated a Bloomberg journalist using a verified X account. The victim received a DM with a fake Calendly link leading to an OAuth authorization page for a malicious app named "Iphone IOS." Granting access allowed the app to post crypto spam from the victim's account. The incident highlights vulnerabilities in X's verification system, where purchased blue checks and deceptive bios facilitate trust scams.
Related event: Phishers impersonate Bloomberg reporters to hijack X accounts(3 posts)→
More from Safety
- Anthropic red team's first-ever model "abliteration" cut GLM-5.3 refusals from 90% to 3% for ~$4,400 — cephaloform · 2026-10-16
- Anthropic grants METR employee-like access as independent safety evaluators go public — AnthropicAI · 2026-10-16
- APEX-Harm benchmark: script-based injection attacks easily compromise agents in shared workspaces — KAUST · 2026-10-16
- Residual-stream forecasts predict agent violations before they happen, USC study shows — USC · 2026-10-16
- AI safety drama: risk research called a 'company effort,' team lead responds — logangraham · 2026-10-16
- Brave's Leo adds end-to-end encrypted chat with GLM via attested TEE — gnukeith · 2026-10-16