According to @galnagli on Twitter, a credential harvester operating at tcoredirecting.com/tc2 has been active since November 2025, yet had no public reporting until now. The harvester specifically targets Twitter users by stealing their OAuth tokens before redirecting them to a legitimate Calendly link, disguising the malicious activity. This incident highlights significant security risks for platforms using OAuth and underscores the need for improved threat detection and user education in AI-driven authentication systems, as reported by @galnagli.