Neutron 🔀 (@Neutron_org): Today the Neutron Foundation team regained full access to the @Neutron_org Twitter account following a malicious phishing attack.

Today the Neutron Foundation team regained full access to the @Neutron_org Twitter account following a malicious phishing attack. ​ Here’s what happened, how we responded, and the steps we’re taking to prevent this from happening again ⤵️ ​ What Happened ​ On November 28th, a malicious actor mimicked a copyright infringement email from Twitter and reproduced Twitter's website with high fidelity to obtain the Neutron account's ID, password, and one-time password generated by the 2FA authenticator from our social media manager. This allowed the attacker to: ​ • Log out all other sessions and alter 2FA settings, preventing recovery • Delegate posting access to another account they controlled • Setup a passkey from a mobile to access the account if the password was reset • Post malicious links promoting a scam token on pump.fun ​ Fortunately, the Neutron community quickly reported the malicious activity, and the potentially harmful tweets were rapidly removed. ​ How We Responded ​ • Community Alerts: As soon as the compromise was identified, we alerted the community via personal Twitter accounts and our official Telegram and Discord channels to safeguard funds. • Standard Recovery Efforts: We attempted to recover the account using the uncompromised email address using the standard process but were prevented from completing the effort due to the changed 2FA. • Escalation within Twitter: Although the incident occurred during the Thanksgiving holiday in the US—when Twitter Support’s response was limited—we leveraged industry connections to get the issue escalated within Twitter to expedite account recovery. • Account Recovery: By December 4th, we regained access, secured the account, and implemented immediate protections: ​ • Logged out all sessions and reset credentials • Removed the attacker’s delegated access • Set up new 2FA measures ​ However, a bug in the Twitter mobile app prevented us from clearing passkeys from the account. The fact that passkeys only appear on mobile and cannot be selectively removed is a known issue with Twitter’s security UX. To prevent the attacker from using a passkey to regain access, we temporarily locked the account until this issue was resolved. On December 9th, the bug was fixed, and we successfully removed all passkeys. ​ The account is now fully secure. ​ The Outcome ​ Thankfully, we have no evidence that any community member lost funds, and no other Neutron Foundation services were affected. This was a targeted attack on the @Neutron_org Twitter account, and we’ve taken the following measures to prevent future incidents: ​ • Mandatory Physical Security Keys: All critical services and team members, including social media accounts, will now require hardware-based security keys. • Enhanced Security Training: Our team will complete comprehensive security training to better identify and prevent attacks. • Policy Reassessments: We’re thoroughly reviewing and upgrading all internal security protocols. ​ Thank you to everyone in the community who swiftly reported the malicious activity to assist in minimizing harm and expediting account recovery. Transparency and security remain top priorities, and we will continue to learn and adapt to protect the Neutron ecosystem. If you have any concerns, questions, or suggestions, please don’t hesitate to reach out via the official Neutron Telegram channel: t.me/neutron_commun…