Criminals using Twitter Promoted Tweets to phish

Tweet says it can help get your account verified, but actually steals credit card information

Malwarebytes has uncovered a phishing campaign that uses Twitter's Promoted Tweets to pull people in, promising them that they can become verified while actually stealing credit card information.

The tweet reads simply "Get Verified. Go to goo.gl/zuGHjg." When the link is clicked, it takes the user to an official-looking landing page with the text: "Welcome to Twitter Verification. Hundreds of millions of people use Twitter to discover what's happening in the world. Twitter can help you connect with them and achieve meaningful results.

"Being verified is more than a cool badge on your profile, it signifies authenticity and ensures the community that you are an official account."

To get verified, the web page claims your username, email address, company name, phone number and password is needed, plus other information related to a Twitter Ads account and how many followers the victim has.

It then asks for a card number, expiry date, security code, name, billing address, and contact email, which it claims, it uses to prove the person is who they say they are.

"To prevent identity confusion, Twitter is now offering the "verification form". We're working to establish authenticity with people who deal with impersonation or identity confusion on a regular basis. Accounts with a [Tick] are the official accounts."

The page is listed as being secure until the payment details are requested, at which point the browser flags the page as containing insecure content.

Malwarebytes discovered that although this flag may have deterred some wary people, the Tweet was clicked by 812 people and almost all of those clicked on the link to the phishing website. The majority of users accessed the phishing site using an iPhone and were from the US.

Twitter hasn't yet commented on the vulnerability, neither has it revealed whether they are vetted. The site's FAQ simply says they're the same as other tweets and can be retweeted, replied to and liked, but are just used to spark engagement from existing followers.

Featured Resources

Next-generation time series: Forecasting for the real world, not the ideal world

Solve time series problems with AI

Free download

The future of productivity

Driving your business forward with Microsoft Office 365

Free download

How to plan for endpoint security against ever-evolving cyber threats

Safeguard your devices, data, and reputation

Free download

A quantitative comparison of UPS monitoring and servicing approaches across edge environments

Effective UPS fleet management

Free download

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021