Hackers Leave Credential Stuffing Botnet Wide Open With Full Worker Access and Root Passwords

Cybersecuritynews •Tushar Subhra Dutta • April 14, 2026

A live credential stuffing botnet targeting Twitter/X accounts has been found completely exposed to the internet, with no password required to access its control panel, worker server credentials, or real-time attack data. The exposed system, running under the name “Twitter Checker Master Panel – FULL FIX v2.3,” left root SSH passwords for all 18 worker […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Credential Stuffing Botnet Exposed with Full Access to Attack Infrastructure A credential stuffing botnet targeting Twitter/X accounts has been discovered fully exposed online, allowing unrestricted access to its command-and-control infrastructure. The botnet, named 'Twitter Checker Master Panel – FULL FIX v2.3', is hosted on a Windows Server 2019 instance in Germany and has left its control panel and worker server credentials publicly accessible without any password protection. This exposure includes root SSH passwords for all 18 worker servers, enabling potential attackers to manipulate the botnet easily. The incident raises significant concerns about the security of user accounts on Twitter/X, as the botnet is actively engaged in credential stuffing attacks. No specific vulnerabilities (CVEs) were mentioned, but the lack of security measures poses a critical risk. The botnet's full operational capabilities are currently available to anyone who knows where to look. As of today, the botnet remains exposed and operational. 2 sources 64

Extracted Entities

Hackers Leave Credential Stuffing Botnet Wide Open With Full Worker Access and Root Passwords

The full story

Extracted Entities

Attack Types (2)

Companies (2)

MITRE ATT&CK (1)

Tools (1)