A verified social account can look like the safest thing on your feed: same name, same avatar, same tick. That trust is exactly what attackers want when they take the account over. In October 2024, the Federal Bureau of Investigation (FBI) Atlanta Division warned that cybercriminals were hijacking verified influencer accounts — often through phishing or social-engineering messages — then using those profiles to push cryptocurrency “giveaway” links and free-software downloads that install malware.
DFRLab’s case work on deepfake Musk lives also showed the “traveling circus” pattern: a large verified YouTube channel is rebranded overnight, a crypto live runs for hours, then the owner fights to recover the handle on Discord and X. Separately, security reporters have tracked waves of Discord account takeovers that blast friends with screenshots of a MrBeast-branded “crypto casino” giveaway — the trusted chat is the delivery system, not proof the creator posted it.
The giveaway pitch is usually blunt: send crypto to a site and get double back, or claim a prize before a timer runs out. The link may harvest wallet details or walk you into a site that never pays out. The “free bot” or “trading tool” variant is quieter but just as nasty: the download is info-stealing malware that grabs usernames, passwords and session cookies so more accounts can be compromised. Followers who trust the blue tick are more likely to click without the usual scepticism they would apply to a random stranger.
Treat an out-of-character post as a warning light. Creators who never talk about crypto suddenly announcing a double-your-deposit draw, or pushing a Windows installer from a brand-new domain, are classic tells. Do not assume the verified person is in control of every post. Open a second channel you already know is theirs — their website, an older pinned post, a verified app listing — and ask whether that giveaway exists. Skip urgency. Skip “just send a little to start.” If a link worries you, check how recently the domain was registered; a site that appeared last week with a polished giveaway page is not a household brand.
If you already clicked a download, disconnect from the network, run a reputable malware scan, and change passwords from a clean device — especially email and social logins. Report the hijacked post to the platform and, if money or credentials were taken, use the routes on Get help. Anyone who then offers to “recover” the coins for a fee is often running a second scam: read Fake recovery first.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.