Photo: Santeri Viinamäki / Wikimedia Commons / CC BY-SA 4.0
A single malicious social media post could trigger a stock market crash or allow cybercriminals to scam customers out of millions of dollars, Naveh Ben Dor, CEO and founder of Israeli cybersecurity company Spikerz, warned on the sidelines of Tel Aviv University’s Cyber Week on Tuesday.
Speaking to The Jerusalem Post, Ben Dor said social media accounts have become one of the most overlooked vulnerabilities in corporate cybersecurity, and companies often lack the tools to detect and prevent malicious activity on their official channels.
Spikerz, which won the “CISO’s Choice: Fire Pitch” competition during Cyber Week’s main plenary session, aims to address that vulnerability by protecting companies’ external digital assets, including social media accounts, advertising platforms, websites, and mailing lists.
The company says it currently protects accounts with a combined following of more than 1.6 billion, serving clients worldwide, including professional sports teams, international brands, and celebrities.
“We protect anything that sits outside the perimeter,” Ben Dor told the Post.
According to the company, its technology identifies unusual activity on official corporate channels, removes malicious content, and helps secure compromised accounts.
Ben Dor pointed to the 2013 hacking of the Associated Press’s Twitter account by the Syrian Electronic Army, a pro-Syrian government hacking group, as an example of how a single false social media post can have far-reaching financial consequences.
The compromised account published a false report about an attack on the White House, triggering a brief but sharp stock market decline.
“That incident created a market crash of $130 billion,” he explained.
Securing one of the most vulnerable areas from cyberattacks
During his Cyber Week pitch, Ben Dor said Spikerz focuses on a part of corporate cybersecurity that many organizations take for granted, leaving critical digital assets without adequate protection against attacks.
One of the company’s areas of focus is phishing attacks targeting corporate social media accounts, particularly through direct messages that may lack the same security protections available to traditional company email systems.
“What we see is that all the domains of social media and other platforms are basically neglected, and you have a lot of potential to hijack accounts through those platforms, you know, internally. That is something we built our model around,” he said.
Ben Dor described an incident involving one of Spikerz’s clients, whose Instagram account was compromised after an employee on its social media team fell victim to a phishing attack.
According to Ben Dor, the employee received a message from someone impersonating Meta, claiming that the company’s Instagram account had violated copyright laws. The employee was then tricked into handing over the account’s login credentials.
After gaining access to the account, the attackers used it to promote a cryptocurrency scam, Ben Dor said.
He stressed that such incidents can cause more than immediate financial damage, potentially undermining years of work spent building a company’s reputation and earning customers’ trust.
“Years of work can go to the trash because of these types of mistakes,” he added.
AI agents emerge as a growing cybersecurity threat
Beyond phishing attacks, Ben Dor identified two additional vulnerabilities affecting companies’ social media accounts: former employees who retain access to corporate accounts and artificial intelligence agents operating without adequate oversight.
He warned that employees who retain login credentials after leaving a company could potentially misuse those accounts, while current employees could also deliberately publish harmful content.
“An employee can go rogue and post something against the company. And this again can hurt the company in several aspects and be prevented by having a solution that constantly scans for these types of anomalies in the communications,” he said.
According to Ben Dor, unauthorized access by current and former employees was one of the main concerns facing companies just one or two years ago.
“Somebody comes and goes. The type of alerts nobody pays attention to because they don’t touch your organization. You don’t really know who has access to the accounts.”
However, he said the emergence of agentic AI, systems capable of independently carrying out tasks, has introduced a new set of cybersecurity risks, particularly when organizations lack clear rules governing their use.
“Your social media manager could log in to the company’s account from his personal phone and link it to ChatGPT without you even knowing. There is no governance,” he explained.
Ben Dor described a case in which a company allegedly lost millions of dollars after allowing an AI agent to manage an advertising campaign.
“For example, we had a company that just came to us. They ran an advertising campaign with an AI, and the AI decided to send the campaign budget to a different website. $2.2 million gone. And then what? Good luck trying to get it back,” he said.
He argued that unlike human employees, who generally understand the consequences of their actions, AI agents may execute instructions without recognizing their potential financial or reputational impact.
“An employee has some common sense, like, ‘Okay, I don’t want to steal from my company, so I won’t physically do it.’ But an agent is only following a prompt,” he said, and added that this lack of clear rules is the main risk nowadays.
_(cropped).jpg){kind=link}