Breaking911 Twitter Account Hacked to Spread Fake Musk Shooting

The @Breaking911 account on X — a popular aggregator with over 1.2 million followers that bills itself as "America's #1 Alternative News Source" — was compromised and used to broadcast a fabricated report claiming Elon Musk had been shot. The fake post, designed to generate panic clicks, directed users to external links tied to a cryptocurrency scam [1][2].

The incident is the latest in a surge of high-profile account hijackings on Elon Musk's own platform, where trusted brands and news outlets are being systematically targeted by cybercriminals who weaponize their audiences for financial fraud.

The Anatomy of the Attack

The playbook is now disturbingly familiar. Hackers gain control of a verified, high-follower account and immediately post sensational content — in this case, a fabricated report of violence against one of the world's most recognizable figures. The goal is not to spread misinformation for its own sake, but to exploit the spike in attention and emotional urgency to funnel victims toward malicious links [3].

Breaking911, founded in 2011 by T. Grant Bernson, operates primarily as a Twitter-native news aggregator that repackages breaking headlines with minimal original reporting [4]. Media Bias/Fact Check has rated it a "Questionable Source" based on clickbait headlines and a lack of transparency [5]. But its 1.2 million followers — many of whom have notifications enabled for breaking news alerts — make it an extraordinarily valuable target for hackers seeking maximum reach in minimum time.

The fake Musk shooting post likely followed the same template seen in dozens of recent account takeovers: a sensational headline paired with a link that redirects to a cryptocurrency "giveaway" or investment page, where victims are tricked into sending digital assets to wallets controlled by the attackers [3][6].

A Pattern of Escalating Attacks

The Breaking911 hack is not an isolated event. It fits squarely within a campaign that security researchers at SentinelOne have been tracking since mid-2024, in which hackers systematically target high-profile X accounts through phishing operations [7].

The attackers send emails impersonating X's security team — claiming a suspicious login or copyright violation — and direct targets to credential-harvesting pages hosted on domains like x-recoverysupport.com and securelogins-x.com. Once credentials are captured, the legitimate owner is locked out and the account is repurposed for fraud [7].

Recent victims of this or similar campaigns include:

• Greg Gutfeld (Fox News host, 3.1 million followers) — hacked on February 7, 2026, with scammers posting cryptocurrency promotions and sending phishing DMs to his entire follower base [8]
• The Tor Project — breached on January 30, 2025 [7]
• Linus Tech Tips — compromised in mid-2024, with approximately 1.8 million followers exposed [7]
• Yahoo News UK, Neymar Jr., Lenovo India, and Oliver Stone — all hijacked in a September 2024 operation promoting a Solana-based token called $HACKED [9]
• The U.S. Securities and Exchange Commission — its official X account was breached in January 2024, with hackers posting a fake Bitcoin ETF approval that briefly moved global markets [10]

SentinelOne traced the phishing infrastructure to IP addresses hosted by a Belize-based VPS provider, with domains registered through a Turkish hosting company. Source code comments in the phishing pages were written in Turkish, though researchers cautioned against definitive attribution [7].

The Underground Economy Behind Account Takeovers

The attacks are sustained by a thriving black market. A CloudSEK investigation found that compromised X Gold and Grey verified accounts are sold on dark web marketplaces for between $1,200 and $2,500 — a price that reflects the enormous profit potential of reaching millions of followers with a single scam post [3].

The economics are stark. According to Chainalysis, cryptocurrency scams generated an estimated $17 billion in stolen funds in 2025, up from $12 billion in 2024. Impersonation scams — the category that account takeovers fall into — grew by a staggering 1,400% year-over-year, with the average fraudulent payment jumping from $782 to $2,764 [11].

Source: Chainalysis 2026 Crypto Crime Report

Data as of Mar 18, 2026CSV

The sophistication is increasing as well. AI-enabled scams now generate 4.5 times more revenue than traditional approaches, with deepfake videos of public figures like Elon Musk deployed across hijacked YouTube channels and social media accounts to lend credibility to fraudulent schemes [11][12].

Why X Is Particularly Vulnerable

The platform's security posture has been a subject of intense scrutiny since Musk's 2022 acquisition. Significant reductions in X's trust and safety teams — including an estimated 80% cut to content moderation staff — have left the platform with fewer resources to detect and respond to account compromises [13].

In March 2025, Musk himself acknowledged a "massive cyberattack" against X, stating it was carried out "with a lot of resources" by "either a large, coordinated group and/or a country" [14]. A separate breach exposed over 200 million user records, including email addresses, usernames, and profile data — a treasure trove for phishing campaigns seeking to target high-value accounts [15].

The platform's verification overhaul has compounded the problem. The old blue checkmark system, while imperfect, required identity verification. The current system allows anyone to purchase a blue check for $8 per month, making it easier for scammers to create convincing impersonation accounts and harder for users to distinguish legitimate from fraudulent sources [3].

The Misinformation Multiplier

Beyond the financial fraud, the Breaking911 incident highlights a more insidious threat: the use of trusted news accounts to inject fabricated events into the information ecosystem during a period of genuine geopolitical crisis.

The hack occurred against the backdrop of an ongoing U.S.-Israeli military campaign against Iran, a period when audiences are particularly primed to believe sensational breaking news about public figures. A fake report of Elon Musk being shot — the owner of both X and SpaceX, a government contractor with deep ties to the current administration — could theoretically move markets, trigger security responses, or incite real-world panic before corrections can spread.

Research from DemandSage found that 86% of global citizens have encountered misinformation online, while 40% of content shared on social media is fake [16]. The World Economic Forum's Global Risks Report 2026 placed misinformation and disinformation among the top short-term global risks, alongside geoeconomic confrontation and societal polarization [17]. The annual economic cost of fake news is estimated at $78 billion globally, including $39 billion in stock market losses [16].

Source: DemandSage / Various Research Sources

Data as of Mar 18, 2026CSV

The exploitation of breaking-news formats is a deliberate tactical choice. When hackers hijacked YouTube channels during the July 2024 Trump assassination attempt, they deployed deepfake Elon Musk videos within hours, capitalizing on the chaotic information environment to push cryptocurrency scams [12]. The Breaking911 hack follows the same logic: manufacturing a crisis to exploit the human instinct to click first and verify later.

What Users Can Do

Security researchers recommend several protective measures [7][8]:

• Enable two-factor authentication using an authenticator app, not SMS
• Use unique, strong passwords for social media accounts
• Never click login links in emails claiming security issues — go directly to the platform instead
• Be skeptical of sensational breaking news that includes external links, especially involving cryptocurrency
• Report compromised accounts immediately to help platforms respond faster

For account owners with large followings, SentinelOne specifically warns against engaging with emails about copyright violations or suspicious logins, which are the primary phishing lures used in the current campaign [7].

A Systemic Problem Without a Clear Solution

The Breaking911 hack is a symptom of converging failures: a platform with diminished security infrastructure, a booming criminal economy built on account theft, and an information environment where trust in news sources is at historic lows — just 28% of Americans now trust mainstream media [16]. Each successful attack further erodes the reliability of the channels people depend on for real-time information.

Until X invests meaningfully in account security and phishing prevention — or until regulators force the issue — the incentive structure remains firmly in the hackers' favor. A compromised account with a million followers can generate thousands of dollars in cryptocurrency fraud within minutes, while the platform's response time is measured in hours. In that gap between breach and recovery, the damage is already done.