X users are being hit by fake login alerts: the phishing emails look real

X users are being targeted right now with fake security emails. They claim a new device signed into your account and try to push you into acting before you slow down and look closely.

The links in those messages can send you to X lookalike login pages built to steal your credentials, or to malicious app-authorization prompts. And the emails mimic X’s branding so closely, the colors, the formatting, even the polished support language, that they can pass for the real thing at a glance.

If you use X regularly, check the sender first. X says legitimate account and security emails should come from @X.com or @e.X.com. Hover over links before you click, and watch for fuzzy login details, missing session information, or an alert that somehow leaves out your @handle.

X also says it will never ask for your password by email, direct message, or reply.

If one of these emails shows up, don’t click anything in the message. Check your X account directly instead.

If you’ve already entered your password or a one-time code, change your password, turn on two-factor authentication, and review connected apps so you can remove anything you don’t recognize. Stolen X accounts get used for crypto scams, impersonation, misinformation, and more phishing, and researchers say social media scams hit 429 million hacked accounts in 2025 with $17 billion in projected losses.