Two weeks after a massive breach saw hackers take over some of the most prominent accounts on Twitter — including Barack Obama, Elon Musk, Joe Biden and Bill Gates — the company has published more details about how it happened. While a number of people from the “OGUsers” gray market forum provided details about a “Kirk” who was the source of access to internal tools, it was unclear how they came by that access in the first place.

Twitter

According to Twitter, the answer is a phone spear phishing attack that targeted a “small number” of employees who did not all have access to management tools. However, attackers then “used their credentials to access our internal systems and gain information about our processes.” Twitter didn’t confirm a report that the access came from finding logins for the admin tool in a Slack channel, but it didn’t quite rule that out either, nor did it provide any clarity about who may have been behind the initial attack.