Twitter DM Phishing Scam

Use Netsparker


As Twitter gains momentum there are more and more attacks on it, it’s users and the most recent is a phishing scam via DM (Direct Message).

It was uncovered recently that it was being used as a Botnet Control Channel, shortly before that it was subjected to a DoS attack.

This isn’t the first time DMs have been used in a Phishing attack too.

Phishers are targeting Twitter users in a new attack involving direct messages sent to Twitter users containing a link to a site requesting user log-ins.

There are reports of a new phishing scam making the rounds on Twitter. The attack seeks to steal user credentials by sending tweets out with links to a phishing site. The attack site requests the user’s log-in information; once the attackers have that, they can take over the account of the victim and use it to send out more messages.

According to messages from Twitter users, the tweets with the link to the phishing site have to do with the sender supposedly making a certain amount of money. Such periodic phishing attacks on users of the popular microblogging service have become a fact of life.

I’m not exactly sure why anyone would want to steal a bunch of Twitter accounts? Perhaps to monetize them somehow with spam/affiliate schemes.

But the current threat on Twitter is a phishing scam executed via DM with a link to various things including ways to make money, a video of you or some other juicy gossip.

The cornerstones of social engineering in phishing attacks.

In May, researchers at Sophos reported that a number of Twitter users were lured to a phishing site via a tweet with the message: “check this guy out [tinyurl address leading to the attack site].” As was the case in that instance, URL shortening services are increasingly being abused by attackers to mask the Websites they are sending their victims to.

Besides drawing attackers as it has grown, Twitter has also gotten the interest of security researchers, as shown by the “Month of the Twitter Bugs.”

Twitter warned users about the attack, stating in a message: “A bit o’ phishing going on—if you get a weird direct message, don’t click on it and certainly don’t give your log-in creds!”

If you are using Twitter you should follow @spam and keep up to date with what is happening on the network.

Source: eWeek

Posted in: Phishing, Privacy, Spammers & Scammers

, , , ,


Latest Posts:


snallygaster - Scan For Secret Files On HTTP Servers snallygaster – Scan For Secret Files On HTTP Servers
snallygaster is a Python-based tool that can help you to scan for secret files on HTTP servers, files that are accessible that shouldn't be public and can pose a s
Portspoof - Spoof All Ports Open & Emulate Valid Services Portspoof – Spoof All Ports Open & Emulate Valid Services
The primary goal of the Portspoof program is to enhance your system security through a set of new camouflage techniques which spoof all ports open and also emulate valid services on every port.
Cambridge Analytica Facebook Data Scandal Cambridge Analytica Facebook Data Scandal
One of the biggest stories of the year so far has been the scandal surrounding Cambridge Analytica that came out after a Channel 4 expose that demonstrated the depths they are willing to go to profile voters, manipulate elections and much more.
GetAltName - Discover Sub-Domains From SSL Certificates GetAltName – Discover Sub-Domains From SSL Certificates
GetAltName it's a little script to discover sub-domains that can extract Subject Alt Names for SSL Certificates directly from HTTPS websites which can provide you with DNS names or virtual servers.
Memcrashed - Memcached DDoS Exploit Tool Memcrashed – Memcached DDoS Exploit Tool
Memcrashed is a Memcached DDoS exploit tool written in Python that allows you to send forged UDP packets to a list of Memcached servers obtained from Shodan.
QualysGuard - Vulnerability Management Tool QualysGuard – Vulnerability Management Tool
QualysGuard is a web-based vulnerability management tool provided by Qualys, Inc, which was the first company to deliver vulnerability management services as a SaaS-based web-service.


3 Responses to Twitter DM Phishing Scam

  1. Max Moses F. September 24, 2009 at 6:39 pm #

    I’m somewhat baffled by phishing attacks on Twitter, given that there’s practically no discernible value in hijacking an account. Perhaps the attack was inspired by boredom? Or sheer distaste for Twitter? I have trouble imagining a practical way to monetarily capitalize on the control of thousands of Twitter accounts. At any rate, I always have to grin when social engineering hacks trump modern security measures. (Not that Twitter is especially secure, but numerous other examples demonstrate my point.) I can’t help but think that, even with the most advanced technologies, hackers will inevitably attain some degree of success by taking advantage of other peoples’ ignorance.

    I’m a big fan of your blog. Your posts are tasteful, informative, and interesting to read. As a new blogger myself, I’m acclimating to the digital writing realm with exercises in critical reading/writing, and have made your blog a central element of my critiques. You might be interested in reading my thoughts on your work:
    hackedplanet.blogspot.com

    Keep up the good work!

  2. Darknet September 25, 2009 at 4:19 am #

    Max Moses F.: Interesting stuff you have there, you have an analytical mind and a good grasp of writing. Keep it up. My replies to comments very much depend on my mood, and as you’ve picked up I do have a very low tolerance for idiocy. Just remember when it comes to blogging content is king, so be consistent and original and you’ll be fine. Good luck!

  3. hannibal September 30, 2009 at 7:16 am #

    Exactly what Max said i wanted to say too… It is really interesting how Social engineering dodges every kind of anti scam or hack security measure. As Kevin Mitnick already wrote there is more power to humans being hacked then the best brute force algorithm.