[Thread] - 1) Good evening sports fans! Ready for the ultimate hacked verified Twitter accounts thread? Over the past two years, I have kept tabs on around 70 verified accounts that were hacked by Arabic language operators for various reasons. The victims #disinformation
2 / range from 30 international athletes, to other public figures such as deceased US Senator Debbie Smith. The accounts have been used for various purposes, from scams to state propaganda. Some of the accounts are still active, while many have been suspended - read on for more!
3/ First up, Senator Debbie Smith. Smith, who served as a member of the Nevada Senate, sadly passed away in 2016 after battling with a brain tumour. Her Twitter account was hacked by an Arabic-speaking account, which changed it's handle to @0YY0k - and was eventually suspended
4/ If you search twitter for the late Senator's twitter handle, "sendebbiesmith", you will find people interacting with the account in Arabic still. From a security perspective, it's a little worrying how a politican's account can be compromised
5/ British rugby fans may recognize Jason Netherton, a former rugby league player for Hull Kingston Rovers. @netherton_jason's account @jasnev16 was hacked, and while Netherton complained, it doesn't look like he got his account back. It's now an Arabic 'parody' account
6/ Sticking with British rugby. Hayden Stringer, a prop (former?) with @Saracens was hacked too. His original account, @haydenstringer is still active, but has lost verification status. It spent some time as a #Saudi princess - presumably as part of some sort of monetary scam
7/ Sticking with rugby, but moving to Australia, we have league player @PritchardFrank. Frank had his account restored, but looked like it spent some time as a random dude, as well as another Saudi princess Lulwa Al Faisal Bint Abd Al Aziz Al Saud.
8/ Sticking with the theme of Saudi princesses. Professional football Dylan Mottley-Henry, who plays for @larnefc, and used to play for @officialbantams , enjoyed a stint as a Saudi princess Sahab Abdulla bin Abdul Aziz. His account still exists, but is unverified and protected
9/ Moving to the US Baseball player Ronald Guzman ( @_ronaldguzman ) also spent time as a member of the Saudi royal family - according to @JJtheTexan. During his tenure as a Saudi 'royal', Guzman retweeted Saudi humanitarian charity @KsRelief alot. Guzman got his account back
10/ Meet Linebacker AC Leonard, who plays for Canadian football team @sskroughriders . His account @ace_leonard99 - still belongs to 'Reem bin Al-Waleed', who seems to be claiming to be a daughter of Saudi business man AlWaleed bin Talal Al Saud. The account has lost V status
11/ Let's take a music break. Meet Australian band @drawingnorth, who are spending time as Kuwait princess Lulua Mubarak Al Jaber Al Sabah. As far as I know, Drawing North, who featured on @triplejunearthd , did not change their name to Lulua. The account is still verified!
12/ Moving to basketball. Here is @ThadJr12 , an American pro basketball player who plays for @SanPabloBurgos . Thad briefly spent time as Princess Haifa Al Saud, with people addressing him as princess. Thad acknowledges the hack in his bio, but thankfully has his account back.
13/ Another likely financial scam. French cyclist Alexis Gougeard has had his account hacked by someone claiming to be Princess Fahda bint Abdullah Al Saud. The account @gougeardA is still active and verified, and posting pro-Monarchy propaganda #cyclists
14/ The royal family account appear to be financial scams. In one instance, French actor @audreychauveau had her account hacked by Nouf bint bandar Al Saud. After sliding into someone's DMs a Twitter user warned others about the scam. Chauveau's account is now unverified
14/ Will pause this for now, and add more tomorrow!
15 a) Resuming #Olympics coverage today with more hacked verified Twitter accounts of athletes. Meet Jaide Childs, a 2012 US Paralympian swimmer. Jaide's account has been taken over by an Arabic account advertising bitcoin Baby Cake - among other things. #cryptocurrency
15 b) The account also links to a website selling 'distinctive' social media accounts, from instagram to Playstation - presumably some hacked ones? Jaide has met swim ambassador @RyanLochte , maybe he can raise the profile of the issue, it's been hacked for over a year
16) Meet French Rower @mickarowing, his new account purports to be a Kuwaiti new portal. It is still active, but no longer verified. Account has been hacked for over a year, Micka tweeted he would be at #Tokyo2020 hola Micka! #Olympics#Rowing
17) Meet #snooker player Oliver Lines . Lines had his account hacked. He complained to Twitter, as did his colleagues. He did not get his hacked account back & states that on his new profile @OliverLines. His hacked account @oliverlines147 is still up, although no longer verified
18) Meet US Rowing Blue and 2016 Olympian Felice Mueller. Mueller's account @feliced23 was likely hacked in 2020 by someone alleging to be a pro-Saudi monarchy account. Note all the Arabic speaking accounts replying to her account. The account is now suspended #Olympics2021
19) Meet Brazilian Democratic Movement politician @MauroMariani15. His account has been hacked by someone claiming to be an ethical hacker (irony what?) and digital criminal investigator. The account is still active & verified, offering to restore hacked accounts! #CyberSecurity
20) Here is US baseball player Blake Battenfield. His account @blake_bfield2 has been hacked by someone purporting to be based in Saudi, who sells pimped out phones and other things.. It is still hacked and still verified #BaseBall#cybersecurity
21) Another 'Saudi princess' here; Lulwa Al-Faisal Al Saud. They hacked the account (@Belegendary19) of American Footballer Derrick Jones, previously of New York Jets, & others. Account still verified, & has been hacked for over a year. RTs dodgy Saudi news portal @SaudiNews50
22) Journalists beware. The account of Australian Journalist Ticky Fullerton @bizticky has been hacked by dodgy phone salesperson in Saudi (looks like the same account that hacked @blake_bfield2 - see tweet no. 20). Account is still verified & hacked. #CyberSecurity@RSF_inter
23) Journalists beware. The account of 13WMAZ Morning Anchor @KatelynHeck was hacked. Katelyn got her account back as you can see, although some of her Arabic tweets are still evident. #CyberSecurity#Hacking
24) For the Australian rules football fans. Meet former @brisbanelions player @zac_oby , Zac o Brien. Zac had his account hacked by an entity purporting to be Kuwaiti news portal that. It is still verified, and tweets on a regular basis. #CyberSecurity#deception#hacking
25) Meet Olayinka Sanni, Nigerian American pro basketball player. Her account @olayinkasanni was hacked in 2020 by someone claiming to be 'Faisal bin Khalid Al Saud' and is now suspended. Olayinka @olayinkasanni10 noted the hack but nothing happened. #cybersecurity
26) Any Indian #cricket fans?Sarabjit Ladda @10Ladda had his verified account hacked as far back as 2019 & taken over by someone purporting to be one Ibrahim Hamdan living in Jordan. He even hacked/bought the corresponding Instagram account @10Ladda (Just Batsman #CyberSecurity
27) Fans of Ultra-Conservative blogging may know Bob Livingston. His verified account @personalliberty was taken over around 2020 by Arabic news account "news 35". The account is up but no longer verified. It tweeted a lot of pro-UAE/anti Qatar/Turkey propaganda #disinformation
28) Academics beware. @susan_weich , Assistant Professor of Journalism at @LindenwoodU and former crime reporter has had her verified account taken over around 2020 by 'Susan AlKhaldi', who is allegedly based in Saudi and does financial reporting #CyberSecurity#AcademicTwitter
29) One of the victims of hacking, belonging to rugby player @netherton_jason ( original hacked account = @jasnev16 ) got in touch to say that @TwitterSupport never got back to him. That's not cool at all. The hacked account is still live and erm, hacked. #CyberSecurity
30) Any @BGT fans out there. Do you remember father son band @TheNeales ? They even got top 25 in the UK charts. Now the account is someone claiming to be Saudi Princess Naifa bin Talal Khalid Al Saud. Looks like a sick relative scam. Account is very much active and verified #BGT
31) Just a note that I have it on good authority that some people are approached about selling their verified accounts. It is not clear in which instances this is the case. #cybersecurity#disinformation
32) Baseball fans may recognize former @cardinals player Barret Browning (I'm not a bball fan). His account @backwoodsbb was hacked back in 2019. It's still up, but not verified anymore. Now belongs to 'Dasman' who reports to be based in Kuwait. #Cybersecurity#disinformation
33) Bennie Fowler, a wide receiver for the @49ers had his account hacked back in 2020 by someone who change the account to 'Ibn Watan' (arabic). The account disappeared and the handle has now been taken by a new ghost account set up in June 2021 #Cybersecurity#49ers
34 a) Pittsburgh @Pirates pitcher Tyler Anderson had his account @andersontj08 hacked in 2018 by an account that renamed itself 'Ahmed for marketing services', reportedly based in Saudi. The account offered social media services. If you search #Cybersecurity
34 b) for the number in the screenshot, it takes you to a youtube channel offering to sell Twitter followers and automatic retweets (at a good price!). The number is a Saudi number. FYI Tyler's account no longer exists. RIP. #cybersecurity#disinformation
34 c) if you search the number on Twitter you'll find a few accounts (including previously hacked verified account @reghud) offering various services. One account leads to website of Saudi-based Marketing company, which offers fake followers, RTs, trending services, verification
I will resume this thread tomorrow! Peace out #cybersecurity
• • •
Missing some Tweet in this thread? You can try to
force a refresh
🧵1/ I analysed the headline and lead paragraph of 536 English news articles including the terms "Maccabi" + "Amsterdam" and classified them using Claude 3.5 Sonnet to determine how many framed Israelis as victims or non-Israelis as primary victims (as well as both).
2/ The results are fairly striking. 65% of articles frame Israelis as the victim, while only 5% frame Non-Israelis as victims. 24% are neutral while 9% framed both groups as victims. Quite clear the media emphasised violence as anti-Israeli and antisemitic, especially early on
3/ There isn't much evidence too of corrective framing at this point, although a small increase in neutral framing a week after the incident. Israeli victimhood was categorised as emphasis of violence initiated by non-Israelis, and focus on anti-Israeli or antisemitic violence
🧵 1/ Part of understanding what is going on in Amsterdam is also to understand the coordinated anti-Arab, anti-Muslim and anti-immigrant campaigns run with huge amounts of money targeting Europe. Here's a short private Eye article about an investigation I did with @SohanDsouza
2/ Here's a write-up by @karamballes on the campaign in @BylineTimes "Disinformation Campaign on Social Media Reached More Than 40 Million People – but Meta ‘Alarmingly’ Hasn't Revealed the Culprits' bylinetimes.com/2024/08/30/qat…
@karamballes @BylineTimes 3/ ...How a covert influence campaign helped Europe’s far right
Our findings about the shadowy multi-platform operation attacking Qatar and stoking Islamophobia to further its far-right agenda in Europe and beyond call for immediate action. aljazeera.com/opinions/2024/…
🧵🚨1/ This is nuts. After mysteriously deleting a package covering the Amsterdam protests, Sky News have put up a new version. The new version completely changes the thrust to emphasise that the violence was antisemitic. See the opening screenshot change below
2/Even the tweet accompanying the video has changed. It has explicitly shifted from mentioning anti-Arab slogans to removing the phrase "anti-Arab" and using antisemitism. It also removes mention of vandalism by Israeli fans. An extremely clear editorial shift!
3/ They have also inserted into the video, right after the opening footage of Dutch Prime Minister condemning antisemitsm. This was not in the original video.
1/ If you break down the BBC's live reporting of what happened in Amsterdam, you can see the disproportionate attention it pays to Maccabi fans and Israelis as victims, with far less attention paid to the actions of Maccabi fans. Here are the sources interviewed.
2/ In terms of mentions of Arab, Dutch or other Ajax fans, there is very little emphasis on Arab safety, with the majority of coverage focused on Maccabi fans as victims. There are vox pops with fans, but very little interaction with non-Maccabi people.
3/ The language used to describe the attacks on the Maccabi fans is also much stronger, ranging from pogroms to brutal and shocking. Similar terms aren't use for the anti-Arab racism.
🚨1/ This New York Times piece is wild. Let's go through it.
Firstly, the lede is an emphasis that attacks in Amsterdam were based on antisemitism, yet it cites no evidence of this, but DOES cite evidence of anti-Arab chants.
2/ The claims of antisemitism are based primarily on the Prime Minister of the Netherlands, who tweeted that the attacks were antisemitic. Note - the Dutch Prime Minister didn't call out anti-Arab or anti-Palestinian racism from Maccabi fans.
3/ The piece links to an Amsterdam police statement to talk about the violence - although the police statement doesn't mention anything about antisemitism.
🧵 'At least 1,800 bots on the social media site X are promoting the controversial choice of Azerbaijan, a major oil and gas producer, to host next month’s ...#COP29, according to a new analysis shared exclusively with The Washington Post".
2/ The analysis by Marc Owen Jones, an expert on disinformation at @NUQatar, focused on roughly 2,800 X accounts that collectively sent around 10,800 tweets, retweets and replies about the conference between Oct. 17 and Oct. 24.
3/ Detection
73% of all accounts active in sample created in the space of 3 quarters in 2024.
Conservative estimates suggest 66% (1876) accounts in the sample are fake (bots) based on activity over the past week