Worked example · 2020-07

Twitter internal-tool compromise and Bitcoin scam campaign — 2020-07-15

Loss

at least $118,000 in bitcoin fraud losses per the NYDFS investigation, as summarised by Hinshaw [hinshaw1]. The incident is structurally foundational for the T15.001 + T4.007 chain: a social-engineering compromise of a major platform's internal tools was weaponised to push scam content through verified high-follower accounts. Three people were charged: two in a federal complaint (N.D. California) and one, a 17-year-old, in Florida state court [sophos1][aljazeera1]. The Florida defendant, Graham Ivan Clark, pleaded guilty to 30 charges and received a three-year sentence followed by three years of probation [abcplea].

OAK Techniques observed

OAK-T15.001 (Social Engineering of Operator Personnel) — primary; the attackers used phone-based spear-phishing (vishing) and social-engineering techniques to persuade Twitter employees to grant access to Twitter's internal administrative tools, which included the ability to reset account email addresses, disable multi-factor authentication, and post tweets as any account. The T15.001 page's "credential-and-access" sub-pattern is directly exercised: the attackers did not compromise Twitter's infrastructure through software exploitation; they persuaded authorised personnel to grant them access to the tooling that Twitter employees themselves used to perform account-support actions. OAK-T4.007 (Native App Social Phishing Engagement on Weighted Platforms) — the scam tweets posted from verified high-follower accounts (45 tweeted from, per [sophos1]) (including Bill Gates, Elon Musk and Joe Biden per the IRS affidavit [sophos1]) constituted a platform-native phishing campaign where the trust signal was not a fake domain or a spoofed email — it was the verified-checkmark and follower-count of the compromised accounts themselves. The attack exploited the platform's own trust infrastructure (verified status, follower graph) as the amplification mechanism. OAK-T8.001 (Cluster Reuse) — the scam Bitcoin addresses used in the Twitter hack were retained from the original classification; the cited sources do not state that forensic vendors linked the addresses to prior campaigns, so this mapping is unverified. OAK-T7.001 (Mixer-Routed Hop) — retained from the original classification; routing through mixers is not stated in the cited sources.

Attribution

confirmed. The U.S. Attorney's Office for the Northern District of California announced charges on 2020-07-31 against Mason Sheppard ("Chaewon", 19, of Bognor Regis, UK: conspiracy to commit wire fraud, conspiracy to commit money laundering, intentional access to a protected computer) and Nima Fazeli ("Rolex", 22, of Orlando, Florida: aiding and abetting intentional access to a protected computer); the third defendant, 17-year-old Graham Clark, was charged by the Hillsborough County State Attorney's Office in Tampa [doj1][sophos1]. The cited sources confirm Clark's guilty plea and sentence [abcplea]; they do not establish pleas or sentences for Sheppard and Fazeli.

Key teaching point

Platform-internal-tool compromise converts individual-user security diligence into an irrelevant control — the attacker is operating from inside the platform's trust boundary, and no user-side countermeasure can prevent posting as the compromised account. Callers posing as Twitter IT staff persuaded four employees to hand over credentials [hinshaw1]; the administrative tooling those employees used then became the attack path.

Corrected 2026-10-11

Defendant name corrected from "Nino" to Nima Fazeli; removed the claim that all three defendants pleaded guilty (confirmed only for Clark), the "~130 accounts compromised / ~400 victim transactions / mixer / Chainalysis-TRM cluster" claims (sources give 45 accounts tweeted from, $118K+ losses), and unsourced Senate-inquiry and two-hour verified-account-block specifics.