The crypto community faces a new type of X account hijacking attack that can bypass two-factor authentication.

ChainCatcher reported that cryptocurrency developer Zak Cole has disclosed a new type of phishing attack targeting X (formerly Twitter) accounts of crypto community members. This attack disguises itself as an authorization request from the Google Calendar app, luring users into granting full account control permissions. Attackers exploit X platform's app authorization mechanism, completely bypassing passwords and two-factor authentication.

MetaMask security researchers have confirmed that this attack is active in the wild. Users are advised to visit the connected apps page on X, check for and revoke suspicious "Calendar" app authorizations to ensure account security.