# Technique T0011: Hijack legitimate account

* **Summary**: Hack or take over legimate accounts to distribute misinformation or damaging content. Examples include Syrian Electronic Army (2013) series of false tweets from a hijacked Associated Press Twitter account claiming that President Barack Obama had been injured in a series of explosions near the White House. The false report caused a temporary plunge of 143 points on the Dow Jones Industrial Average.

* **Belongs to tactic stage**: TA04


| Incident | Descriptions given for this incident |
| -------- | -------------------- |
| [I00042 Saudi/Qatar bot dispute](../incidents/I00042.md) | “hack” of Qatar’s official news agency |



| Counters | Response types |
| -------- | -------------- |
| [C00053 Delete old accounts / Remove unused social media accounts](../counters/C00053.md) | D4 Degrade |
| [C00098 Revocation of allowlisted or "verified" status](../counters/C00098.md) | D2 Deny |
| [C00133 Deplatform Account*](../counters/C00133.md) | D3 Disrupt |
| [C00153 Take pre-emptive action against actors' infrastructure](../counters/C00153.md) | D3 Disrupt |
| [C00182 Redirection / malware detection/ remediation](../counters/C00182.md) | D2 Deny |
| [C00189 Ensure that platforms are taking down flagged accounts](../counters/C00189.md) | D6 Destroy |
| [C00197 remove suspicious accounts](../counters/C00197.md) | D2 Deny |


DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW