Victim was drained due to the WallStreetBets ATO on X/Twitter where a phishing site was posted.
Attackers recently have been
exploiting a bug with X on mobile where after compromising an account they add pass keys which currently are not shown to the original account owner and previously were not being reset by support.