Hackers are exploiting a decade-old loophole in Twitter accounts. Before July, Twitter did not require e-mail verification of their accounts. This meant anyone who didn’t want to give Twitter their e-mail address could just register an account using a fake e-mail address without ever having to click a confirmation link. Users typed in random letters or words using @gmail, @hotmail, @yahoo, etc., and never thought about it again.

Now the Islamic State has discovered that if they uncover dormant accounts with these fake addresses, they can go create the Gmail, Hotmail, or Yahoo accounts themselves. They sent password reset e-mails to the newly-created e-mails and gained access to old Twitter handles to spread propaganda.

If you created a Twitter account a while back and stopped using it, now is the time to delete it!

According to TechCrunch, the scheme was discovered by a hacker and security researcher known as WauchulaGhost, who devotes his time to disrupting the online activities of the Islamic State. He said some of the hacked accounts had tens of thousands of followers.

WauchulaGhost provided a list of hacked accounts to TechCrunch and reported them to Twitter. Many of them have now been deactivated.

Over the last few days, followers of the hacked accounts saw videos in Arabic of Islamic State fighters wielding weapons. Other Tweets contained Arabic text praising violence and terrorist attacks. Some instructed readers to commit acts of violence against non-believers. The hacked accounts also retweeted each other constantly, creating a wave of pro-terrorist propaganda across Twitter.

According to TechCrunch, who reviewed many of the Tweets before they were removed:

“One tweet, roughly translated, used an Islamic State hashtag: ‘…with your cars, let’s go pack, you bomb, go with a bomb, you go in any way.’ Another hijacked account called on Muslims to ‘kill these Christians wherever you find them,’ while another account tweeted about turning the Christmas holidays ‘into grief and horror.'”

While the Islamic State claims to be a Muslim authority, they are a radical group whose actions don’t reflect the teachings of Islam.

While Twitter did respond, they have largely shirked responsibility, telling TechCrunch:

“Reusing email addresses in this manner is not a new issue for Twitter or other online services. For our part, our teams are aware and are working to identify solutions that can help keep Twitter accounts safe and secure.”

This is a disappointing reaction in an age when social media has played a role in everything from election scandals to genocide. It’s clear Twitter wants to do some work to clean up social media. But one wonders why they haven’t been more vigilant.

Twitter has removed over a million accounts that promoted terrorism since August 2015. In July of 2018, they cracked down on bot accounts that violent groups were using to spread propaganda. Nonetheless, they failed to prevent the latest hack.

This isn’t the first time the Islamic State has hacked into Twitter accounts. In 2015 they were able to gain access to the US Military’s Central Command to post threatening messages and videos.

The Islamic State has been on the other side of a Twitter hack as well, courtesy of WachulaGhost. Acting under the banner of the hacker collective Anonymous, over 200 accounts associated with the terrorist group received an LGBT-friendly rainbow makeover back in 2016.