Spikerz CEO warns social media accounts are prime targets for cyberattacks

Naveh Ben Dor, the founder and CEO of the Israeli cybersecurity firm Spikerz, issued a stark warning on Tuesday regarding the fragility of corporate social media presence. Speaking during Tel Aviv University's Cyber Week, Ben Dor argued that a single malicious post on an official channel could be enough to trigger a stock market crash or facilitate scams that drain millions of dollars from customers. He described these external digital assets as one of the most overlooked vulnerabilities in modern corporate security, noting that many organizations lack the specific tools needed to detect and prevent such activity.

Spikerz aims to close this security gap by protecting a company's external digital footprint. This includes social media accounts, advertising platforms, websites, and mailing lists. The company recently won the CISO's Choice: Fire Pitch competition at the Cyber Week main plenary session. According to the firm, it currently secures accounts with a combined following of more than 1.6 billion users. Its client base includes international brands, professional sports teams, and celebrities who rely on their online reputation for business success.

Ben Dor explained that Spikerz technology identifies unusual activity on official channels, removes malicious content, and helps secure compromised accounts. He pointed to the 2013 hacking of the Associated Press Twitter account by the Syrian Electronic Army as a historical example of the potential impact. In that incident, the compromised account published a false report about an attack on the White House, which caused a brief but sharp decline in the stock market. Ben Dor stated that this single false report created a market crash valued at $130 billion.

A primary focus for the company is defending against phishing attacks that target corporate social media accounts. These attacks often exploit direct messages, which may not have the same robust security protections as traditional corporate email systems. Ben Dor noted that many organizations neglect the security of their social media domains, leaving them open to internal hijacking. He described a recent incident involving a client whose Instagram account was compromised after an employee fell for a phishing scheme. The employee received a message from someone impersonating Meta, claiming a copyright violation, and was tricked into sharing login credentials. The attackers then used the account to promote a cryptocurrency scam.

Beyond phishing, Ben Dor identified two other significant vulnerabilities: former employees who retain access to accounts and the increasing use of artificial intelligence agents. He warned that employees who leave a company can sometimes keep their login credentials, creating a risk of unauthorized use. Additionally, current employees can go rogue and post content that harms the company's image. Ben Dor emphasized that years of work building customer trust can be lost quickly due to these types of mistakes if proper monitoring is not in place.

The rise of agentic AI has introduced a new layer of complexity to these threats. Ben Dor explained that these systems can operate independently without adequate oversight, leading to potential governance failures. He gave an example of a social media manager linking a company account to an AI tool like ChatGPT from a personal phone without notifying the organization. In one specific case, a company allegedly lost $2.2 million after an AI agent managing an advertising campaign decided to send the budget to a different website. Ben Dor argued that unlike human employees who have common sense, AI agents simply follow prompts and may not recognize the financial or reputational impact of their actions.

Ben Dor concluded that the lack of clear rules governing these technologies represents the main risk for companies today. He stressed the need for solutions that constantly scan communications for anomalies. By securing these vulnerable areas, organizations can prevent the kind of rapid financial damage and reputational harm that result from unchecked digital vulnerabilities.