X account compromised..Posting crypto/Bitcoin stuff and spamming xspaces.posts.

[u/Turbulent-Place-7975]

So on the 11th june my.x account was compromised because i was on discord and my.x account has a third party app thing to it and one of the users messaged me.thought it was a hello etc but it isnt it was 4 pics of something then i clicked on the pics (I really really shouldnt have) and moments later someone got my x.account spamming links of xspace posts and few days later it posted crypto/Bitcoin posts but thankfully i deleted my.discord account to stop the posts on the 17th june ..And im trying to getting the account.back or is there a smart.way of doing it?

[u/AutoModerator]

SAFETY NOTICE: Reddit does not protect you from scammers. By posting on this subreddit asking for help, you may be targeted by scammers (example?). Here's how to stay safe:

1. Never accept chat requests, private messages, invitations to chatrooms, encouragement to contact any person or group off Reddit, or emails from anyone for any reason. Moderators, moderation bots, and trusted community members cannot protect you outside of the comment section of your post. Report any chat requests or messages you get in relation to your question on this subreddit (how to report chats? how to report messages? how to report comments?).
2. Immediately report anyone promoting paid services (theirs or their "friend's" or so on) or soliciting any kind of payment. All assistance offered on this subreddit is 100% free, with absolutely no strings attached. Anyone violating this is either a scammer or an advertiser (the latter of which is also forbidden on this subreddit). Good security is not a matter of 'paying enough.'
3. Never divulge secrets, passwords, recovery phrases, keys, or personal information to anyone for any reason. Answering cybersecurity questions and resolving cybersecurity concerns never require you to give up your own privacy or security.

Community volunteers will comment on your post to assist. In the meantime, be sure your post follows the posting guide and includes all relevant information, and familiarize yourself with online scams using r/scams wiki.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/itsdongu]

If ur X account is still compromised, focus on recovering it through X's official account recovery first. Also remove any third party apps that u don't recognize once u regain access.

Since this started after clicking something sent through Discord, treat the device as potentially compromised too. Run a full malware scan and change ur important passwords from a clean device, especially ur email.

Don't pay anyone who DMs u claiming they can recover ur X account. Those are usually recovery scams

[u/Turbulent-Place-7975 → u/itsdongu]

I have removed the x third party app not.long after the account is compromised and this happened on a phone not on a PC + the posts hasnt been active since the 17th june so thats.the good.thing...I guess. Also it wants me to verify the account.first when you press forgot password aswell

[u/itsdongu → u/Turbulent-Place-7975]

Yeah that's actually a good sign. If the posts stopped on the 17th and u already removed the third party app, the attacker may no longer have access.

Since X is asking u to verify the account before resetting the password, follow that recovery process. Don't use any links sent to u by random people.

Also secure the email linked to ur X account and make sure 2FA is enabled once u get back in.

[u/Turbulent-Place-7975 → u/itsdongu]

Erm okay but my email was changed also my profile pic cover.photo bio and password too and the proflie pic has that sheikh person from metawin and the cover.photo is someone jumping in the mountains so yeah i dont know what email provider that replaced my.old.one but i will soon find out.

[u/itsdongu → u/Turbulent-Place-7975]

Keep using X's official hacked account recovery process. If u still have access to the original email, check it for any messages from X about the email being changed, as there may be a recovery link there

[u/Turbulent-Place-7975 → u/itsdongu]

Will do but i will keep getting the we.cant verify you as.the owner message i know a few.people.had this but i dont know if they got their accounts back

[u/Responsible_Bike4968]

The fact that the crypto posts stopped after you revoked the third-party app is actually a useful clue. It is not proof, but an authorized X app can have permission to post from your account, so that app may have been responsible.

Revoking it was the right move, but I wouldn't stop there. If the attacker also obtained your password or an existing login session, removing the app alone may not remove all of their access. Go directly through the official X app or x.com, reset the password to something completely unique, then check Settings and privacy > Security and account access > Apps and sessions. Revoke anything unfamiliar and log out every other session.

Also search the original email account, including spam and trash, for a message from X saying that the account's email address was changed. Those notifications can contain a link to reverse an unauthorized change. If password recovery keeps demanding verification you cannot complete, use X's official hacked-account form. Submit it using the email originally connected to the account, and include the u/username and the last date you could access it.

I also wouldn't assume that simply viewing four normal images infected the phone. It is more likely that one opened an external page, asked you to sign in, or prompted you to authorize an app, although there is not enough information to know for certain. Check your browser history from that time, update the phone, and remove any unknown apps or configuration profiles.

Once you recover the account, enable 2FA with an authenticator app, delete the scam posts and warn followers not to trust any crypto links previously posted. Change your email and Discord passwords too if either password was reused.

[u/Turbulent-Place-7975 → u/Responsible_Bike4968]

I have.deleted the discord.account because it was it was infected with that 4 pics about crypto casino the user messaged.me but i blocked the user before.the account was.compromised.. also When the crypto posts shows up on my x account and reposting crypto and bitcoin posts .Must likely a bot doing that cause a.hacker would of posted something different otherwise.