Twitter DM Phishing Scam

Use Netsparker


As Twitter gains momentum there are more and more attacks on it, it’s users and the most recent is a phishing scam via DM (Direct Message).

It was uncovered recently that it was being used as a Botnet Control Channel, shortly before that it was subjected to a DoS attack.

This isn’t the first time DMs have been used in a Phishing attack too.

Phishers are targeting Twitter users in a new attack involving direct messages sent to Twitter users containing a link to a site requesting user log-ins.

There are reports of a new phishing scam making the rounds on Twitter. The attack seeks to steal user credentials by sending tweets out with links to a phishing site. The attack site requests the user’s log-in information; once the attackers have that, they can take over the account of the victim and use it to send out more messages.

According to messages from Twitter users, the tweets with the link to the phishing site have to do with the sender supposedly making a certain amount of money. Such periodic phishing attacks on users of the popular microblogging service have become a fact of life.

I’m not exactly sure why anyone would want to steal a bunch of Twitter accounts? Perhaps to monetize them somehow with spam/affiliate schemes.

But the current threat on Twitter is a phishing scam executed via DM with a link to various things including ways to make money, a video of you or some other juicy gossip.

The cornerstones of social engineering in phishing attacks.

In May, researchers at Sophos reported that a number of Twitter users were lured to a phishing site via a tweet with the message: “check this guy out [tinyurl address leading to the attack site].” As was the case in that instance, URL shortening services are increasingly being abused by attackers to mask the Websites they are sending their victims to.

Besides drawing attackers as it has grown, Twitter has also gotten the interest of security researchers, as shown by the “Month of the Twitter Bugs.”

Twitter warned users about the attack, stating in a message: “A bit o’ phishing going on—if you get a weird direct message, don’t click on it and certainly don’t give your log-in creds!”

If you are using Twitter you should follow @spam and keep up to date with what is happening on the network.

Source: eWeek

Posted in: Phishing, Privacy, Spammers & Scammers

, , , ,


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


3 Responses to Twitter DM Phishing Scam

  1. Max Moses F. September 24, 2009 at 6:39 pm #

    I’m somewhat baffled by phishing attacks on Twitter, given that there’s practically no discernible value in hijacking an account. Perhaps the attack was inspired by boredom? Or sheer distaste for Twitter? I have trouble imagining a practical way to monetarily capitalize on the control of thousands of Twitter accounts. At any rate, I always have to grin when social engineering hacks trump modern security measures. (Not that Twitter is especially secure, but numerous other examples demonstrate my point.) I can’t help but think that, even with the most advanced technologies, hackers will inevitably attain some degree of success by taking advantage of other peoples’ ignorance.

    I’m a big fan of your blog. Your posts are tasteful, informative, and interesting to read. As a new blogger myself, I’m acclimating to the digital writing realm with exercises in critical reading/writing, and have made your blog a central element of my critiques. You might be interested in reading my thoughts on your work:
    hackedplanet.blogspot.com

    Keep up the good work!

  2. Darknet September 25, 2009 at 4:19 am #

    Max Moses F.: Interesting stuff you have there, you have an analytical mind and a good grasp of writing. Keep it up. My replies to comments very much depend on my mood, and as you’ve picked up I do have a very low tolerance for idiocy. Just remember when it comes to blogging content is king, so be consistent and original and you’ll be fine. Good luck!

  3. hannibal September 30, 2009 at 7:16 am #

    Exactly what Max said i wanted to say too… It is really interesting how Social engineering dodges every kind of anti scam or hack security measure. As Kevin Mitnick already wrote there is more power to humans being hacked then the best brute force algorithm.