Phishing For Twitter Credentials

Cyberscammers are going after login credentials for Twitter in a big way. At least, that’s if my own Twitter friends are any indication for trending.

In the last week, two of the people I follow on Twitter and who follow me back had their accounts hijacked and abused to send out spam and malicious links via direct message, Twitter’s system for sending private messages to friends who use the service.

Twitter phishing message.

The scams are very similar to what you might see in an instant message or in an e-mail. A message arrives from a friend saying: “haha. This you????” or “Lol. this you??” followed by a link. This is a straightforward phishing scam. The link takes the target to a Web site that looks like a Twitter sign in page, but is not. If you look at the URL you see that it is hosted elsewhere and the actual Twitter looks slightly different as well.

Fake Twitter login page.

Recognizing a fake login page can be hard, especially if you’re using a mobile device to tweet. So keep in mind to think twice whenever you’re asked to type in credentials, especially after you just clicked on a link and didn’t follow your bookmark or typed in www.twitter.com yourself.

We regularly see scams that dupe people into giving up their credentials for online services by presenting a fake login page. These fake login pages are designed to look just like a legitimate login page for a service like Twitter, Facebook, Yahoo. Traditionally cybercriminals have gone after credentials for online payment, banking and auction sites.

The scammers use credentials for social networking sites to spam all the victim’s contacts. This increasingly happens on Facebook and Twitter. Users should use phishing protection like the technology in McAfee’s security suites and McAfee SiteAdvisor in addition to practicing good Internet safety habits like double checking where links take you to and not typing in a user name and password after following a link in an e-mail, instant message or Twitter direct message.

If it was just your account that got phished/hacked:

1. Change your password immediately
2. Change the password on any service where you used the same password
3. Change the password on any service that uses Twitter like Twitterfeed
4. Notify your contacts what happened and apologize (after all, you were just a victim yourself)

(Hat tip to McAfee Labs colleagues Toralv Dirro and Dave Marcus for their help in compiling this blog posting.)

Tags: Consumer, Cybercrime, facebook, malware, phishing, twitter