REPORT : 2020 Q1

This report offers insight into large account takeovers trends that happened over the first quarter of 2020.

Netflix, Spotify, StockX, Hulu, and Houseparty stood out.


Netflix : Very large attack shortly after pandemic declared on 2020-03-11s.

Spotify : "Playlist" fraud. ATO'd accounts either sold for normal usage, or, playlist fraud used to make money.

StockX : Fraudulent purchases starting off the quarter.

Hulu (1 & 2)

Houseparty appears at the end of the quarter. Press (1,2,3). Possibly a false positive, but under strange conditions. Aggressive single-day runups like this are usually FP, but the tweets suggest real malicious account activity. However, the company suggests it is a misinformation operation.


The following data has no analysis and includes frequently seen companies that regularly fight ATO.

This is a total summary of all tweets meeting my criteria.

This is a breakdown of totals per @mention which helps find outliers.


The following were reviewed for unusual activity.