We know, we knew within 45 seconds of it happening, we know exactly how it happened, the impact is limited to this dumb Twitter account, the last bits of resolving this involve working X.com, we'll say more later.

glad to hear it's limited.

Be careful, do not use the link on their account at the moment

I messaged CEO + CTO, and posted on the forum, this attack seems very targeted, only started after everyone is offline, fake website was well done.

I'm waiting for confirmation that nothing else was breached in fly.

Do we need to rotate env vars and change passwords too or is it limited to those that logged into the fake website?

Nothing happened to our website. This is just a Twitter thing.

Gotcha, thanks. Got worried for a second when I saw the screenshot of the website in the post.

That's a link from an unauthorized tweet made up to look like our website.