ICANN regains control of X account after phishing attack

Phisher posted a crypto scam after gaining account access.

The Internet Corporation for Assigned Names and Numbers (ICANN) has successfully recovered its X (Twitter) account.

On February 11, someone phished an ICANN employee to gain access to the company’s X social media account. They posted a crypto scam, urging people to buy a new token.

The posts were quickly removed, but ICANN didn’t have access to its account until X restored it. That took several weeks; ICANN says it regained access to the account on March 3. It then undertook “internal security testing” and fully restored service on March 6.

Upon resecuring the account, ICANN posted:

Our @ICANN X account has been secured, and normal activity has resumed. On 11 February 2025, unauthorized messages were posted but have since been removed. We appreciate your patience and support as we resolved the issue. As a reminder, ICANN will never ask for payments or investments on social media. Thank you.

ICANN said it has multi-factor authentication on all of its social media accounts. Given ICANN’s role in the internet ecosystem, it would be helpful for the organization to share exactly what happened to help others avoid falling for a similar scheme.