iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CloudSek reported that advertisements for compromised X accounts bearing gold checkmarks appeared in dark-web marketplaces and on Telegram. CSO Online summarized the findings on Jan. 5, 2024; its report describes observed listings and quotes, not a measure of the market today or proof that advertised accounts were sold.
What CloudSek reported seeing
According to CloudSek’s findings as reported by CSO Online on Jan. 5, 2024, gold-verified X accounts were advertised in dark-web social-media sales sections, and CloudSek also observed promotions on Telegram. The report does not establish how many accounts were compromised, how representative the listings were, or whether the same advertisements remain available now.
CloudSek said organizational accounts that had been inactive since before 2022 were common targets. It described the gold badge as part of the accounts’ appeal to potential buyers, but the report does not establish current X verification rules or eligibility.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How the reported account takeovers worked
CloudSek described two routes to gaining access. Both involved credentials already exposed or obtained elsewhere; the report did not present them as a weakness unique to X.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Credential reuse against dormant accounts
In credential stuffing, attackers try previously exposed username-and-password combinations on other services. CloudSek reported this approach against dormant organizational accounts and said buyers favored accounts obtained this way for their exclusivity.
Credentials collected by information-stealer malware
The other route involved logins collected by information-stealer malware and later offered in malware logs. CloudSek described this method as easier to carry out because such logs were abundant. These are the report’s observations, not a claim that all attackers use either method in the same way.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
After gaining access, thieves could change account recovery details and advertise the account for sale, according to the report. That could make it harder for the legitimate organization to regain control.
Recommended Free Tools
Why a compromised organizational account could be valuable
A buyer could exploit the account’s existing identity and audience to make harmful posts look more credible. CSO Online said the accounts could be used to spread disinformation, job or cryptocurrency scams, and phishing links. The report also described corporate accounts pointing followers to lookalike domains that used different top-level domains from the legitimate site.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The badge and follower count were among the factors CloudSek reportedly observed in listings. A gold checkmark should not be treated as proof that an account is currently controlled by the organization it appears to represent.
What the 2024 price figures mean
The numbers below are asking prices and a reported seller quote described by CSO Online on Jan. 5, 2024. They are not independently audited statistics, verified completed sales, or current market prices.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Reported figure | What it referred to | Qualification |
|---|---|---|
| $1,200–$2,000 | Advertisements for gold-badged accounts | CloudSek reportedly said prices varied by brand and follower count; these were advertised prices in the 2024 report. |
| $35 per account | A quote for 15 inactive X accounts | A source quoted in the report said the seller offered 15 accounts each week; this was a reported quote, not confirmation of a transaction. |
| 720 accounts per year | Implied total at 15 accounts each week | CSO Online’s arithmetic projection from the reported weekly offer, not a measured annual sales total. |
What account owners can take from the report
CloudSek’s advice, as summarized by CSO Online, was to close accounts that have been dormant for an extended period and to use strong password-protection practices after suspected credential theft. The article does not provide a detailed security checklist or establish additional controls as CloudSek recommendations.
Free tools Windows power users keep installed
One-click scans. No signup required.
The practical concern is that old organizational accounts can remain exposed even when nobody is actively posting. Organizations should identify accounts that no longer serve a purpose and decide whether to close them; for accounts that remain in use, password-protection practices matter particularly if credentials may have been stolen.
What the report does not establish
- Whether these dark-web or Telegram listings still exist, or whether the reported prices have changed since January 2024.
- The size of the overall market or the number of compromised accounts; the article gives no representative sample size or prevalence estimate.
- How many advertised accounts were successfully sold or later used for abuse.
- Current X verification, recovery, or account-security policies.
The account of the findings is based on CSO Online’s summary of CloudSek’s study; the underlying study was not independently available in that report. CloudSek also said some providers had operated shops for over four years and used the same medium to advertise “Twitter Gold” accounts, a historical observation rather than evidence about current listings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
