The Twitter/X Breach — July 2020

On July 15, 2020, the verified Twitter accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Jeff Bezos, Apple, and Uber were hijacked simultaneously. Every account posted the same Bitcoin scam. The attacker was a 17-year-old in Tampa, Florida.This episode reconstructs how a series of phone calls defeated Twitter's multi-factor authentication through a real-time credential relay, how a single admin tool called Agent Tools gave unrestricted access to every account on the platform, and how the attack escalated from stealing OG usernames to hijacking the accounts of world leaders. The New York Department of Financial Services investigated and found five specific security controls that would have prevented the breach — all of which existed, were documented, and were available. None were deployed.Based on the NY DFS Report (October 14, 2020), United States v. Graham Ivan Clark, and Twitter's own incident disclosures. 📄 Free technical breakdown PDF: zerodaylogs.com0:00 — Introduction0:50 — The Phone Call2:33 — Real-Time Credential Relay3:59 — Why MFA Failed6:04 — Agent Tools: The God Mode Panel7:06 — Inside the Admin System9:23 — Three Phases of the Attack12:22 — The Cascade: World Leaders Hijacked14:34 — Twitter Breaks Its Own Platform17:02 — The Damage Report17:47 — The Deeper Harm: Private Messages19:23 — Tracing the Attackers21:44 — Arrests and Sentencing24:38 — No CISO25:16 — Five Missing Controls28:44 — Why Security Controls Go Undeployed29:01 — Should Platforms Be Stress Tested?30:30 — What Twitter Changed After the Breach31:39 — The Pattern Repeats: MGM 202332:33 — The Question That Remains #cybersecurity #twitter #databreach #infosec #zerodaylogs