Sources share screenshots of an internal control panel they say Twitter workers use to interact with user accounts, which may have enabled account takeovers
After a wave of account takeovers, screenshots of an internal Twitter user administration tool are being shared in the hacking underground.
VICEJoseph Cox
Context & Ripple Effects
This report lands mid-crisis: Twitter has already confirmed a coordinated social engineering attack against employees with access to internal systems, and now screenshots of the actual user-administration panel are circulating in the hacking underground. The leak matters because the tool itself is the prize — whoever can operate it can change ownership and settings on any account.
Anyone holding or reconstructing the panel's workflows gains a direct path into high-value accounts — the same capability Twitter's own employees used for legitimate support requests.
Twitter must immediately treat its internal administration tooling as compromised knowledge, locking down sessions and re-verifying every operator with access.
Second-order effects
The breadth of insider access — over 1,000 staff and contractors per former employees — becomes the story competitors and regulators press on, forcing Twitter to shrink the privileged population and audit help-desk workflows rather than just patch the intrusion vector.
Verification and security vendors serving other platforms gain leverage: buyers now price in the risk that one social-engineered employee exposes their brand's most-followed accounts.
Third-order effects
If the pattern holds, platform security shifts from perimeter defense toward tight governance of internal authority tools — least-privilege access, logged actions, and fewer humans who can touch account ownership at all.
Account-administration panels become recognized as a distinct attack surface across consumer platforms, pushing identity-control-plane design and privileged-access auditing into standard compliance expectations.
The trend: As platforms concentrate account authority in small sets of internal tools, those tools — not passwords — become the primary target, making privileged-access governance the decisive security battleground.
we spoke to two hackers and we were able to independently verify they were in control of hijacked accounts today. One of them said they paid the Twitter employee to help them take over accounts; not sure on the specifics here at the moment
New: multiple sources in or around the criminal world provided screenshots of an internal Twitter panel they say is linked to the account takeovers. Twitter is now removing images of the panel from the social network https://www.vice.com/...
Terminology clarification: The accounts are not being individually hacked as traditionally reported. The Twitter authorization system is being hacked or employee access abused for Account Takeover. You could argue this is semantics, but at least to me there is a difference.
This headline strains the definition of “hacker.” Is it hacking to pay an employee for access to a secure system? They didn't actually break any computer security. They used money. It's super effective. https://twitter.com/...
A rogue employee would explain why this affected such a large number of accounts over an extended period (and possibly why Twitter seemed to struggle to shut this down). https://twitter.com/...
The panel is an example of the issue of insider data access at tech companies. Whereas in other cases hackers have bribed workers to leverage tools over individual users, in this case the access has led to takeovers of some of the biggest accounts on the social media platform.
Reminder: it's a zillion times easier to hack Twitter and take over accounts of Apple, Bill Gates, Jeff Bezos, Joe Biden, and others than it would be to hack their separate websites. Distributed systems are safer.
Today marked the biggest Bitcoin scam I've ever seen, thanks to Twitter's employee panel allegedly being breached. Elon Musk, Bill Gates, Apple & dozens of other high profile accounts got hacked. The hackers posted the same BTC address on all accounts and made ~$60k today 🤦♂️ ht…
“Twitter has been deleting screenshots of the panel and has suspended users who have tweeted the screenshots, claiming that the tweets violate its rules.” https://twitter.com/...
Tech is NOT neutral nor is it apolitical I hope they received enough to get them through that jail time...although if it's a mediocre, white dude, he'll have a book deal, speaking engagements, and a consulting business very soon https://twitter.com/...
Excuse me, but what's up with that screenshot showing you have a “Search Blacklist” and “Trends Blacklist” button for Admins? And why is Twitter censoring anyone who tweets the screenshot? https://twitter.com/...
a pretty sobering thing to read given that we've collectively outsourced our public square to private companies built for viral advertising where security and privacy are imperfect and constantly under attack https://twitter.com/...