Scammers are sending emails that imitate official notifications from X with the aim of stealing users' credentials and gaining access to their accounts. These messages inform about a supposed login from a new device, prompting the victim to act without verifying the communication's authenticity.
At a quick glance, the email appears authentic. It reports that a login occurred on an unknown device and in an inappropriate location, asking the user if they performed this login themselves. The email then recommends changing the password and checking connected applications, which aligns with X's standard security measures. However, the problem lies in the links, which lead to fraudulent pages created to steal passwords or grant attackers access to the account.
The scammers' goal is to obtain the username and password for X, or to prompt the user to approve a malicious link that will give them access to the account without needing to know the password. After the account is compromised, it can be used for other types of fraud, such as cryptocurrency attacks, phishing, and disinformation campaigns.
Visually, the email reproduces the logos, colors, formatting, and even the wording of genuine notifications from X, making it difficult to recognize the deception. Nevertheless, there are details that help identify the attempted fraud:
According to X statements, official emails are sent exclusively from @X.com or @e.X.com domains. The company also emphasizes that it never requests passwords via email, private messages, or reply messages, nor does it send attachments in such communications.
Jake Moore, a global cybersecurity consultant from ESET, advises remaining calm before taking any action. He asserts that the most important thing when receiving such an email is not to panic and not to click on links to provide personal data. Instead, one should open the official application, as any security issue will appear there.
Before clicking any link, it is recommended to check the message headers and ensure that the address belongs to the X.com domain. It is also possible to report suspicious emails using the spam and phishing tools in the email service.
If only the fake page was opened, Moore believes there is likely no cause for concern. However, if a password or authentication code was entered, it is necessary to change them immediately, ensure that two-factor authentication remains active, and follow X's help guide. According to the platform, accounts showing signs of compromise may have a reset password and receive a secure email link to create a new account.
X will implement a new alert system, directly notifying all users who interacted with a post that received a correction through a Community Note via private message (DM). This change was announced by Elon Musk, the owner of the social network, in a post made on the platform itself, without a specific date for the update's release being disclosed.
Currently, when a user likes, shares, or replies to content that has a Community Note, they already receive a warning both in the application and on the X web version. However, these notifications are only triggered after the note is deemed useful and remains visible for a minimum period of 24 hours. The creators of the corrected posts are also alerted, but only after the note has been active for at least six hours.
The modification proposed by Musk consists of transforming this warning into a direct message, using X Chat, instead of a standard notification. The justification for this change lies in the fact that direct messages are considered harder to ignore than conventional notifications, which should increase the likelihood that users become aware of potentially false content.
X incorporated Community Notes as its main method of combating disinformation in 2022, two years after the feature was introduced under the name Birdwatch. This model operates based on collaborative corrections made by users themselves, without relying on centralized moderation.
A study published in the journal Nature Communications in May 2026 evaluated 237,180 'cascades'—the term used to describe posts with Community Notes and their respective shares. The research indicated that, although Community Notes are quite effective in reducing the reach of content after annotation, they often appear too late to prevent the initial and most viral dissemination of the information.
The collaborative notes model is not limited to X. In 2025, Meta suspended its third-party fact-checking system in the United States and began testing Community Notes on Facebook, Instagram, and Threads. Furthermore, X itself adjusted its methodology, allowing Community Note collaborators to request that an artificial intelligence (AI) draft the initial note, instead of writing it manually.
